Re: [jose] Comments on draft-barnes-jose-spi-00

[Hannes Tschofenig <[e-mail]>]

"kid" vs. "spi" - both are just identifiers that reference something.
Only the context gives them a meaning.

There is no need to define another parameter.

On 04/02/2013 09:00 PM, Richard Barnes wrote:
> "kid" identifies a key.  "spi" identifies anything/everything.
>
> Think of it this way:
> "spi" --> { "alg", "enc", "zip", "kid", ... }
>
>
> On Tue, Apr 2, 2013 at 1:41 PM, Hannes Tschofenig
> <[e-mail] <mailto:[e-mail]>> wrote:
>
>     I don't understand why you need an additional spi parameter when
>     there is already a kid parameter, which serves the same purpose.
>
>     Here is the kid parameter in the JWE:
>     http://tools.ietf.org/html/__draft-ietf-jose-json-web-__encryption-08#section-4.1.10
>     <http://tools.ietf.org/html/draft-ietf-jose-json-web-encryption-08#section-4.1.10>
>
>     Here is the kid parameter in the JWS:
>     http://tools.ietf.org/html/__draft-ietf-jose-json-web-__signature-08#section-4.1.7
>     <http://tools.ietf.org/html/draft-ietf-jose-json-web-signature-08#section-4.1.7>
>
>     Ciao
>     Hannes
>
>
>     On 04/02/2013 06:58 PM, Jim Schaad wrote:
>
>         Richard,
>
>         There is not yet sufficient detail in this document for me to do a
>         proper evaluation of how things are going to work.  Example
>         questions
>         that I have.
>
>         1. What headers are required and which can  be implicit – for
>         example
>         can the algorithm fields be implicit in the SPI?
>
>         2.Are the integrity value computed across the fully populated
>         header or
>         the SPI header?
>
>         3.Is there a way to forward a message from person A which knows
>         the SPI
>
>         values and person B which does not?
>
>         4.What is the correct algorithm for determining the JWS vs JWE
>         in the
>
>         event that all of the algorithms are implicit
>
>         5.What happens if you have implicit parameters and explicit
>         parameters
>
>         and they do not match?
>
>         6.Is there a recommended way to determine what the SPI
>         parameters are
>
>         going to be?  Does the application need to pre-parse the message
>         to get
>         the SPI value or is there a recommendation that some type of
>         callback be
>         included
>
>         7.Can you make things like the IV be implicit?  Thus agree on a
>         starting
>
>         value and an increment and compute the new IV for each new message
>
>         8.If you are requiring that the values be populated by the
>         application –
>
>         does this require that you have a canonical encoding of how
>         those values
>         are placed into the header for the purposes of the integrity check?
>
>         Jim
>
>
>
>         _________________________________________________
>         jose mailing list
>         [e-mail] <mailto:[e-mail]>
>         https://www.ietf.org/mailman/__listinfo/jose
>         <https://www.ietf.org/mailman/listinfo/jose>
>
>
>     _________________________________________________
>     jose mailing list
>     [e-mail] <mailto:[e-mail]>
>     https://www.ietf.org/mailman/__listinfo/jose
>     <https://www.ietf.org/mailman/listinfo/jose>
>
>