Re: [jose] Header criticality -- hidden consensus?
Brian Campbell <bcampbell@pingidentity.com> Fri, 08 February 2013 23:35 UTC
Return-Path: <bcampbell@pingidentity.com>
X-Original-To: jose@ietfa.amsl.com
Delivered-To: jose@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 60A8221F8BCE for <jose@ietfa.amsl.com>; Fri, 8 Feb 2013 15:35:13 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -5.912
X-Spam-Level:
X-Spam-Status: No, score=-5.912 tagged_above=-999 required=5 tests=[AWL=0.064, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-4]
Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SiPfOqX8aF1f for <jose@ietfa.amsl.com>; Fri, 8 Feb 2013 15:35:12 -0800 (PST)
Received: from na3sys009aog105.obsmtp.com (na3sys009aog105.obsmtp.com [74.125.149.75]) by ietfa.amsl.com (Postfix) with ESMTP id 7BAFC21F8BCD for <jose@ietf.org>; Fri, 8 Feb 2013 15:35:12 -0800 (PST)
Received: from mail-ob0-f198.google.com ([209.85.214.198]) (using TLSv1) by na3sys009aob105.postini.com ([74.125.148.12]) with SMTP ID DSNKURWLr+rdyIBE1bD/FDDO6QrhGe/U/tTs@postini.com; Fri, 08 Feb 2013 15:35:12 PST
Received: by mail-ob0-f198.google.com with SMTP id dn14so20946304obc.9 for <jose@ietf.org>; Fri, 08 Feb 2013 15:35:11 -0800 (PST)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=x-received:x-received:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc:content-type:x-gm-message-state; bh=m83jMWa8FaaMseTcRybbngD/xYq8FSETxLOlxK4LgkA=; b=M1XtsAGzPCFCAHrIbNPr18XtxkUwgUz4dxJGrPKeRx0Mpq2wM5NNXb7/at/58EeQtg gYF3vtZyZODXeWLco+nTHBEYFOHumFRXnlgDeOAMh1YTofwA3Vo1qggUQi941hE5qaI2 U+tm8DoudtGVNHf+N8+kzMT69FQCDOWHIwCqfwwI6yR56sY4klIh2k4qkz3yUZ5J3Yfh vLc2RyAnW04yWbQ9Ob8eRReZe/7TvQtpSlgE8diQr0q83fWvOTLWXArSwkVzQiGaFGFY +yi0NSHP5rFvxJKbkI1jTjN1Jyv7eten+5dqaKKyAOi0dXByohhJUcjjaWjfGrm/H+of 6LyA==
X-Received: by 10.50.108.161 with SMTP id hl1mr5932874igb.101.1360366511343; Fri, 08 Feb 2013 15:35:11 -0800 (PST)
X-Received: by 10.50.108.161 with SMTP id hl1mr5932863igb.101.1360366511207; Fri, 08 Feb 2013 15:35:11 -0800 (PST)
MIME-Version: 1.0
Received: by 10.64.139.8 with HTTP; Fri, 8 Feb 2013 15:34:41 -0800 (PST)
In-Reply-To: <CAL02cgRxeS-DomWzVBmoqzps57jgvrUSLn5nrFtqcrTD1wQa=g@mail.gmail.com>
References: <CAL02cgRxeS-DomWzVBmoqzps57jgvrUSLn5nrFtqcrTD1wQa=g@mail.gmail.com>
From: Brian Campbell <bcampbell@pingidentity.com>
Date: Fri, 08 Feb 2013 16:34:41 -0700
Message-ID: <CA+k3eCSbtSTT55J=jOhEQBTDeyu7TM35F_tswt-bKAdd4-VkJw@mail.gmail.com>
To: Richard Barnes <rlb@ipv.sx>
Content-Type: multipart/alternative; boundary="f46d0402a9afaa362604d53f028a"
X-Gm-Message-State: ALoCoQlBsfXQ+UvaBewX8Qg6XCUCv80Rk7u48uDYIKxSANqSswtgQcemGxx1/+WU0swaLnhtcgatTU0T5BxudcVQLGJdfXO0adnl+423zojB2Yey4GU2DukTgSt7GcfmahARQESQF4pQ
Cc: "jose@ietf.org" <jose@ietf.org>
Subject: Re: [jose] Header criticality -- hidden consensus?
X-BeenThere: jose@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: Javascript Object Signing and Encryption <jose.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/jose>, <mailto:jose-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/jose>
List-Post: <mailto:jose@ietf.org>
List-Help: <mailto:jose-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/jose>, <mailto:jose-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 08 Feb 2013 23:35:13 -0000
FWIW, I didn't see my name on the tabulation but I did 'vote' http://www.ietf.org/mail-archive/web/jose/current/msg01461.html On Fri, Feb 8, 2013 at 4:11 PM, Richard Barnes <rlb@ipv.sx> wrote: > We're 24 votes into the header criticality poll, so I thought I would go > ahead and take a look at how the results are shaping up. My initial > tabulation is below. The result on the FIRST POLL (the main one) is as > follows: > > No: 10 > Yes: 14 > > What I find striking, however, is that every single person that voted > "Yes" on the FIRST POLL also voted "Yes" on the SECOND POLL. So nobody who > thinks that all headers should be critical thinks that a JOSE library > should actually be required to enforce this constraint. And that means > that enforcing that all headers are supported cannot be a MUST according to > RFC 2119. > > So I wonder if there's consensus to remove the following text from JWE and > JWS: > -----BEGIN-JWE----- > 4. The resulting JWE Header MUST be validated to only include > parameters and values whose syntax and semantics are both > understood and supported. > -----END-JWE----- > -----BEGIN-JWS----- > 4. The resulting JWS Header MUST be validated to only include > parameters and values whose syntax and semantics are both > understood and supported. > -----END-JWS----- > > Otherewise, a JOSE library conforming to these specifications would be > REQUIRED (a synonym to MUST in 2119) to reject a JWE/JWS that contains an > unknown header, contradicting all those "Yes" votes on the SECOND POLL. > > --Richard > > > > -----BEGIN-Tabulation----- > 1 2 3 Name: > N - - Bradley > N - - Ito > N N A Yee > N N B Barnes > N N B Rescorla > N N C Manger > N N C Octman > N Y A Fletcher > N Y A Miller > N Y A Sakimura > Y Y - D'Agostino > Y Y A Biering > Y Y A Brault > Y Y A Hedberg > Y Y A Jay > Y Y A Jones > Y Y A Marais > Y Y A Nadalin > Y Y A Nara > Y Y A Nennker > Y Y A Solberg > Y Y B Hardt > Y Y B Medeiros > Y Y C Matake > Y Y C Mishra > -----END-Tabulation----- > > _______________________________________________ > jose mailing list > jose@ietf.org > https://www.ietf.org/mailman/listinfo/jose > >
- [jose] Header criticality -- hidden consensus? Richard Barnes
- Re: [jose] Header criticality -- hidden consensus? Mike Jones
- Re: [jose] Header criticality -- hidden consensus? Richard Barnes
- Re: [jose] Header criticality -- hidden consensus? Mike Jones
- Re: [jose] Header criticality -- hidden consensus? Brian Campbell
- Re: [jose] Header criticality -- hidden consensus? Richard Barnes
- Re: [jose] Header criticality -- hidden consensus? Brian Campbell
- Re: [jose] Header criticality -- hidden consensus? Richard Barnes
- Re: [jose] Header criticality -- hidden consensus? Mike Jones
- Re: [jose] Header criticality -- hidden consensus? Mike Jones
- Re: [jose] Header criticality -- hidden consensus? Richard Barnes
- Re: [jose] Header criticality -- hidden consensus? Richard Barnes
- Re: [jose] Header criticality -- hidden consensus? Mike Jones
- Re: [jose] Header criticality -- hidden consensus? Vladimir Dzhuvinov / NimbusDS
- Re: [jose] Header criticality -- hidden consensus? Hannes Tschofenig
- Re: [jose] Header criticality -- hidden consensus? Manger, James H
- Re: [jose] Header criticality -- hidden consensus? Vladimir Dzhuvinov / NimbusDS