Received-SPF: pass (mail26-am1: domain of microsoft.com designates
 131.107.125.8 as permitted sender) client-ip=131.107.125.8;
 envelope-from=Michael.Jones@microsoft.com;
 helo=TK5EX14HUBC103.redmond.corp.microsoft.com ; icrosoft.com ; 
From: Mike Jones <Michael.Jones@microsoft.com>
To: Justin Richer <jricher@mitre.org>
Thread-Topic: [jose] DISCUSS: Nonce/Timestamp parameter
Thread-Index: Ac2CTJhfhDZ21YmQR8aBkF8crw0gfQCF+DqAAAavCgA=
Date: Mon, 27 Aug 2012 18:11:51 +0000
Message-ID: <4E1F6AAD24975D4BA5B1680429673943667AB0E9@TK5EX14MBXC284.redmond.corp.microsoft.com>
References: <4E1F6AAD24975D4BA5B1680429673943667A93F8@TK5EX14MBXC284.redmond.corp.microsoft.com>
 <503B8B2D.7070202@mitre.org>
In-Reply-To: <503B8B2D.7070202@mitre.org>
Accept-Language: en-US
Content-Language: en-US
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Cc: Jim Schaad <ietf@augustcellars.com>, "jose@ietf.org" <jose@ietf.org>
Subject: Re: [jose] DISCUSS: Nonce/Timestamp parameter
Precedence: list

It is.  For those of you wondering what the reference to "issued at" is, se=
e http://tools.ietf.org/html/draft-ietf-oauth-json-web-token-03#section-4.1=
.3.

				-- Mike

-----Original Message-----
From: Justin Richer [mailto:jricher@mitre.org]=20
Sent: Monday, August 27, 2012 7:59 AM
To: Mike Jones
Cc: Jim Schaad; jose@ietf.org
Subject: Re: [jose] DISCUSS: Nonce/Timestamp parameter

How is "issued at" not a timestamp?

  -- Justin

On 08/24/2012 07:02 PM, Mike Jones wrote:
> I'll note for discussion purposes that a nonce and a timestamp are not th=
e same thing (although sometimes they are used to achieve similar/related g=
oals).  A nonce tends to be an opaque value that must be preserved across t=
he communication.  Whereas a timestamp typically has defined semantics - so=
metimes simply a non-decreasing integer value - and sometimes a representat=
ion of time, and then, sometimes with a uniqueness requirement.
>
> For discussion purposes, I'll say that the simplest thing for us to do (s=
hould we decide to do anything in this regard) would be to define the nonce=
 as an opaque string value that must be preserved.
>
> We could also define a timestamp parameter, but as I wrote above, that wo=
uld likely require us to specify additional semantics - starting with wheth=
er it's a non-decreasing integer or a representation of a time value.  This=
 seems much harder to define and possibly to use than a nonce.
>
> Would it make sense to define a nonce parameter now and hold off on defin=
ing a timestamp parameter until there's a clear demonstrated use case for w=
hich a nonce is not sufficient?  That would be my personal recommendation.
>
> 				Best wishes,
> 				-- Mike
>
> -----Original Message-----
> From: jose-bounces@ietf.org [mailto:jose-bounces@ietf.org] On Behalf Of J=
im Schaad
> Sent: Friday, August 17, 2012 12:05 AM
> To: jose@ietf.org
> Subject: [jose] POLL: Nonce/Timestamp parameter
>
> <CHAIR>
>
> If you voted at the face-2-face please do not vote again.  If you want to=
 provide comments please change the title from POLL to DISCUSS.
>
> Do we need to define a nonce/timestamp parameter in the base specificatio=
n?
>
>
>
> Room vote:  6 yes, 0 no, 1 discuss
>
>
> _______________________________________________
> jose mailing list
> jose@ietf.org
> https://www.ietf.org/mailman/listinfo/jose
>
>
> _______________________________________________
> jose mailing list
> jose@ietf.org
> https://www.ietf.org/mailman/listinfo/jose