Re: [jose] #17: add 'aud' and 'iss' to 4.1 Reserved Header Parameter Names

I think it's better for three reasons.  First, I think it's better to reserve the names and define the new processing rules in the document where they're defined - the JWT spec.

Second, the "iss" and "aud" header values aren't meaningful in JWEs in the general case - only in JWEs whose message is a JWT Claims Set.  That's a scoping argument that they shouldn't be defined in the JWE spec.

Third, as is normal for IETF specs, the "one place to look for reserved JWE header names" is the IANA registry for those names.  Yes, the JWE spec reserves an initial set of names, but it won't be the only spec to reserve header parameter names, and so to see the full list, developers have to consult the registry.

				-- Mike

P.S.  There's already an example of the JWT spec reserving names in a registry defined by the JWS spec.  See http://tools.ietf.org/html/draft-ietf-oauth-json-web-token-06#section-9.3.1.  Reserving header parameter names in the JSON Web Signature and Encryption Header Parameters Registry established in JWS (see http://tools.ietf.org/html/draft-ietf-jose-json-web-signature-08#section-7.1.1) would be done in an analogous manner.

-----Original Message-----
From: jose-bounces@ietf.org [mailto:jose-bounces@ietf.org] On Behalf Of Dick Hardt
Sent: Thursday, April 04, 2013 1:10 PM
To: Mike Jones
Cc: draft-ietf-jose-json-web-encryption@tools.ietf.org; jose@ietf.org
Subject: Re: [jose] #17: add 'aud' and 'iss' to 4.1 Reserved Header Parameter Names

On Apr 4, 2013, at 9:27 AM, Mike Jones <Michael.Jones@microsoft.com> wrote:

> JWT defines "aud" and "iss" and reserves them as claim names but not as JWE header parameter names, nor does it currently specify their usage in that location.  My point is that I think the best way to accomplish what you're asking for is to have the JWT spec also reserve these as JWE header parameter names and define the semantics and processing rules associated with using them in that location.

Repeating that you think it is "best" is not educating me on *why* you think it is "best"!

The other reserved JWE header parameter names are not reserved in JWT. The current list of reserved JWE header parameter names are in the JWE document. Having another place to look for what names are reserved looks inefficient and error prone unless ALL reserved JWE header parameter names are listed in JWT.

_______________________________________________
jose mailing list
jose@ietf.org
https://www.ietf.org/mailman/listinfo/jose