Re: [jose] way forward for two remaining drafts

Martin Thomson <martin.thomson@gmail.com> Thu, 02 July 2015 20:26 UTC

Return-Path: <martin.thomson@gmail.com>
X-Original-To: jose@ietfa.amsl.com
Delivered-To: jose@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 99B401A90FB for <jose@ietfa.amsl.com>; Thu, 2 Jul 2015 13:26:38 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2
X-Spam-Level:
X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hbUWLKbocBtN for <jose@ietfa.amsl.com>; Thu, 2 Jul 2015 13:26:37 -0700 (PDT)
Received: from mail-yk0-x230.google.com (mail-yk0-x230.google.com [IPv6:2607:f8b0:4002:c07::230]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 456501A90F7 for <jose@ietf.org>; Thu, 2 Jul 2015 13:26:37 -0700 (PDT)
Received: by ykdr198 with SMTP id r198so78694704ykd.3 for <jose@ietf.org>; Thu, 02 Jul 2015 13:26:36 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=ymtRV/a3zn6vqqHGQLBwE5BQpZCUpmORZRL0MWkflfI=; b=GGxn3aVkqWx6O3+OMv6+oPexBCYdfPSjidpGIip55hwxLLU4cU5rxZHilFdv2/2881 owH0DXiwd9uU5tPhZUcDESwa3H4xX3gorqoT0+oXz3x+TWeY8LhXRudiaSni2TR+rNK4 I/FIaPAcevJvZxYJQ5mJjA6oZyX6bSbiEq4vxjKUKO7M2cTAgAncL5O9L1bS3DMG+19h 6UGY1p27S5NIx1DqZD1rLBNZt1S12gpMoB4Itmb7qbabtkyJc4A5R07c3KurIlGVbvZs oQUhpcT/3u2WEavcxwbaEOGg1C+zfihCqBhaD6uPuzd4xSs8c318k9kddczcZwHdhIMC apUw==
MIME-Version: 1.0
X-Received: by 10.170.124.19 with SMTP id q19mr40892125ykb.1.1435868796650; Thu, 02 Jul 2015 13:26:36 -0700 (PDT)
Received: by 10.129.110.138 with HTTP; Thu, 2 Jul 2015 13:26:36 -0700 (PDT)
In-Reply-To: <8FF9C9E8-7259-4818-ADC2-8D70E4FBB9E9@isoc.org>
References: <8FF9C9E8-7259-4818-ADC2-8D70E4FBB9E9@isoc.org>
Date: Thu, 2 Jul 2015 13:26:36 -0700
Message-ID: <CABkgnnW+keYb4gA79JmgnKUT0hS1Zq3eJS1xKEThkubEmhVHNw@mail.gmail.com>
From: Martin Thomson <martin.thomson@gmail.com>
To: "Karen O'Donoghue" <odonoghue@isoc.org>
Content-Type: text/plain; charset=UTF-8
Archived-At: <http://mailarchive.ietf.org/arch/msg/jose/Dk5VMnnMqUMdUtFNLJqEACW495U>
Cc: "jose@ietf.org" <jose@ietf.org>
Subject: Re: [jose] way forward for two remaining drafts
X-BeenThere: jose@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Javascript Object Signing and Encryption <jose.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/jose>, <mailto:jose-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/jose/>
List-Post: <mailto:jose@ietf.org>
List-Help: <mailto:jose-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/jose>, <mailto:jose-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 02 Jul 2015 20:26:38 -0000

On 1 July 2015 at 08:37, Karen O'Donoghue <odonoghue@isoc.org> wrote:
> https://tools.ietf.org/id/draft-jones-jose-jws-signing-input-options-00.txt

I would like to see some discriminator added to the input for the
(false, false) option this proposes.  As it stands, the payload is the
only input.  Restricting the space of what might be signed ensures
that signatures can't be transplanted.  A fixed string would suffice.