Re: [jose] #15: Broken examples in JWE / JWS

IF your application is always doing something out of band, and IF every
JOSE object you ever receive uses the same out of band channel, and IF the
JOSE library can locate the pre-negotiated parameters based on something
other than the JOSE object, ....

You can see where I'm going with this.  In order for just leaving things
out to be workable, you have to bake some of that out-of-band logic into
your JOSE library.  In which case it's not really out-of-band any more, and
we should specify it.  And clearly specifying security negotiation protocol
is not in scope for this group.

If you have an explicit marking (e.g., SPI), there's a clean interface
between the stuff that only knows JOSE and stuff that does negotiation.

(BTW, +1 to what Jim said)

On Mon, Mar 25, 2013 at 5:54 PM, Mike Jones <Michael.Jones@microsoft.com>wrote:

>  If you already know that something is going on out of band, the
> indication in the JOSE object would be unnecessary.****
>
> ** **
>
>                                                                 -- Mike***
> *
>
> ** **
>
> *From:* jose-bounces@ietf.org [mailto:jose-bounces@ietf.org] *On Behalf
> Of *Richard Barnes
> *Sent:* Monday, March 25, 2013 2:31 PM
> *To:* Brian Campbell
> *Cc:* draft-ietf-jose-json-web-encryption@tools.ietf.org; Jim Schaad;
> jose@ietf.org
>
> *Subject:* Re: [jose] #15: Broken examples in JWE / JWS****
>
> ** **
>
> I realize that's the common case.  But the spec doesn't say that.  ****
>
> ** **
>
> All I'm saying is, the spec should REQUIRE that a sender include either a
> key indicator, or an indication that something is going on out of band.***
> *
>
> ** **
>
> --Richard****
>
> ** **
>
> ** **
>
> On Mon, Mar 25, 2013 at 8:15 AM, Brian Campbell <
> bcampbell@pingidentity.com> wrote:****
>
> /* special magic */ is just some out of band agreement on the key to use
> or how to infer it. Which isn't really special or magic. But probably
> pretty common.****
>
> ** **
>
> On Fri, Mar 22, 2013 at 7:37 PM, Richard Barnes <rlb@ipv.sx> wrote:****
>
> I've renamed the issue to try to clarify.****
>
> ** **
>
> You're right that there are alternative ways to locate a key.  But a JOSE
> object needs to contain at least one of them, or else the /* special magic
> */ clause applies.  ****
>
> ** **
>
> --Richard****
>
> ** **
>
> On Fri, Mar 22, 2013 at 9:15 PM, Jim Schaad <ietf@augustcellars.com>
> wrote:****
>
> This may or may not be a flaw in the specification.  However the item you
> created in the tracker does not reflect what you have put here.  I think
> you would be better served by saying that there is a flaw in the
> specifications in that there should be a MUST that some type of key or key
> reference is required in a JWS or JWE.****
>
>  ****
>
> I would note that your example code should be more complex in that it does
> not deal with jku or any of the x* methods of referencing keys.****
>
>  ****
>
> Jim****
>
>  ****
>
>  ****
>
> *From:* Richard Barnes [mailto:rlb@ipv.sx]
> *Sent:* Friday, March 22, 2013 4:09 PM
> *To:* Jim Schaad
> *Cc:* draft-ietf-jose-json-web-encryption@tools.ietf.org; jose@ietf.org***
> *
>
>
> *Subject:* Re: [jose] #15: Broken examples in JWE / JWS****
>
>  ****
>
> I admit that they are not broken according to the current spec.  However,
> I have a lot of trouble figuring out how I would write code to process them.
> ****
>
>  ****
>
> If "kid" or "jwk" MUST be present to indicate what key I should use, then
> I can have deterministic code:****
>
> if (/* recognized "kid" or "jwk" value */) { ****
>
>     /* use it */****
>
> } else {****
>
>     /* FAIL.  can't process this object */****
>
> }****
>
>  ****
>
> As the spec stands, I have no idea what to put in that "else" clause.  I'm
> clearly not supposed to fail, because the parameters are optional.  But
> what else?****
>
> if (/* recognized "kid" or "jwk" value */) { ****
>
>     /* use it */****
>
> } else {****
>
>     /* insert special magic here */****
>
> }****
>
>  ****
>
> This is actually what SPI is supposed to clear up.  SPI would provide an
> explicit third branch for the special magic to live in.****
>
> if (/* recognized "kid" or "jwk" value */) { ****
>
>     /* use it */****
>
> } else if (/* recognized SPI value */) {****
>
>     /* process using stored parameters */****
>
> } else {****
>
>     /* FAIL.  can't process this object */****
>
> }****
>
>  ****
>
> But without the concept of SPI, the spec is broken because of the
> non-determinism noted above.****
>
>  ****
>
> --Richard****
>
>  ****
>
>  ****
>
>  ****
>
> On Fri, Mar 22, 2013 at 6:13 PM, Jim Schaad <ietf@augustcellars.com>
> wrote:****
>
> My inclination is that this response is correct.
>
> What make you think that the key or key reference is required and cannot be
> implied?
>
> Jim****
>
>
>
> > -----Original Message-----
> > From: jose-bounces@ietf.org [mailto:jose-bounces@ietf.org] On Behalf Of
> > jose issue tracker
> > Sent: Friday, March 22, 2013 2:37 PM
> > To: draft-ietf-jose-json-web-encryption@tools.ietf.org;
> ignisvulpis@gmail.com
> > Cc: jose@ietf.org
> > Subject: Re: [jose] #15: Broken examples in JWE / JWS
> >
> > #15: Broken examples in JWE / JWS
> >
> >
> > Comment (by ignisvulpis@gmail.com):
> >
> >  I think this is not an issue. The examples are NOT broken and they do
> not
> > need a fix.
> >  I suggest to close this ticket.
> >  The draft should definitely not make these illegal. These objects are
> perfect
> > examples for a valid JWS/JWE.
> >
> > --
> > -------------------------+----------------------------------------------
> ****
>
> > -------------------------+---****
>
> >  Reporter:  rlb@ipv.sx   |       Owner:  draft-ietf-jose-json-web-
> >      Type:  defect       |  encryption@tools.ietf.org
> >  Priority:  minor        |      Status:  new
> > Component:  json-web-    |   Milestone:
> >   encryption             |     Version:
> >  Severity:  -            |  Resolution:
> >  Keywords:               |
> > -------------------------+----------------------------------------------
> ****
>
> > -------------------------+---****
>
> >
> > Ticket URL: <http://trac.tools.ietf.org/wg/jose/trac/ticket/15#comment:1
> >
> > jose <http://tools.ietf.org/jose/>
> >
> > _______________________________________________
> > jose mailing list
> > jose@ietf.org
> > https://www.ietf.org/mailman/listinfo/jose****
>
>  ****
>
> ** **
>
>
> _______________________________________________
> jose mailing list
> jose@ietf.org
> https://www.ietf.org/mailman/listinfo/jose****
>
> ** **
>
> ** **
>