IETF Logo Mail Archive

Re: [jose] [Technical Errata Reported] RFC7515 (7767)

Orie Steele <orie@transmute.industries> Thu, 25 January 2024 18:01 UTC

Return-Path: <orie@transmute.industries>
X-Original-To: jose@ietfa.amsl.com
Delivered-To: jose@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BE1D0C14F61D for <jose@ietfa.amsl.com>; Thu, 25 Jan 2024 10:01:16 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.086
X-Spam-Level:
X-Spam-Status: No, score=-2.086 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_KAM_HTML_FONT_INVALID=0.01, T_REMOTE_IMAGE=0.01, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_DBL_BLOCKED_OPENDNS=0.001, URIBL_ZEN_BLOCKED_OPENDNS=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=transmute.industries
Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PV7TEQba_kfV for <jose@ietfa.amsl.com>; Thu, 25 Jan 2024 10:01:12 -0800 (PST)
Received: from mail-pl1-x633.google.com (mail-pl1-x633.google.com [IPv6:2607:f8b0:4864:20::633]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CC01FC14F5EC for <jose@ietf.org>; Thu, 25 Jan 2024 10:01:07 -0800 (PST)
Received: by mail-pl1-x633.google.com with SMTP id d9443c01a7336-1d7858a469aso14529765ad.2 for <jose@ietf.org>; Thu, 25 Jan 2024 10:01:07 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=transmute.industries; s=google; t=1706205665; x=1706810465; darn=ietf.org; h=to:subject:message-id:date:from:in-reply-to:references:mime-version :from:to:cc:subject:date:message-id:reply-to; bh=a0kQejJe9FEDklszGqC/hj1gO55fPpFCt94R6NLrlOY=; b=DJPrlAhHM/rt1c1ZdsYmjSZ9Cj0p6J1Hu8kAOWz/O/3F+Dng//mAP7I5FEheeOF61p pnSwFx8RMh2Mr282HmB3OA7Y7AuXRbcf0Sv8VYw8lgIWQqrbx519bCnqqEp+2+3lH4q/ zjvhhWxcJKSfm0RtRfzPKQmXGTXr4Kjyk4kroDEswyVYApRA+lbyVmH8I332xTZgIYTG R6grIR5hE43JHmI+Xjge9NaAQQY290g/7qXiqXBFAMzY3O/k+G8ONAeaX/dn/VIkh76z 65e9z0nZS/n5UXOZg/KiFz39MAeYQKeiDnXsb+Ke3kJTriH7TL1P60oycvLz1TJgqz+l hXVg==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1706205665; x=1706810465; h=to:subject:message-id:date:from:in-reply-to:references:mime-version :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=a0kQejJe9FEDklszGqC/hj1gO55fPpFCt94R6NLrlOY=; b=Yv7VgSIRL0jQvONnSvQMweXW9d8/BFZ5wva9G66fHNl2IsA7IhuOOJvkZfAfKSbQJn Cqt39Dg+PxBDj1fRaZtqdIKgVMsFSdZY0WQ1fclsR5/dDQb1UjFowPNNi2y9p6rBr6mr orMGGGzNSI90RG5zHM/kGmXVLn3jstg95NaV2tBeAgneHOnGVrn1zhR8qJTwiYPCpJOB 0Ljqkw5eUjtm11j5llpqOj6NJREh8LEbCySJINbKVlmrVZDO4lGWCUJoAx2QslIeqT0z K9XMzQs8P0CJKx5dDAa+t5DrDnS43UABZhDzpiiIHAP5ArCetRRGWkvaoTh8S3sSPG0C 2EXg==
X-Gm-Message-State: AOJu0Yyt8qs0/yod7w0Em19T12Nr5kuOzbrLFLpg5a5xP/7/pZgeWqAQ ktGmMMS64W94XPaDrNQJd56+KISewVLiCZC1XGRk9Et2unjcbs3jgrcSDLrgmojQ+IQtU49Q5zL 3L5r7jCE6xyJokpB1FCbYt+pvK5nWzaRoMROR7qvIQq6DVwLY
X-Google-Smtp-Source: AGHT+IFXJfzw9KphGU0jZrX10Y01Lbgj042O91wnHX/RZpWUyYoa14QOs0DnpsKXhO/mbCabnI8FY6Xqufa0SrrcKLI=
X-Received: by 2002:a17:90b:368c:b0:290:1d59:ec5d with SMTP id mj12-20020a17090b368c00b002901d59ec5dmr1041520pjb.43.1706205663113; Thu, 25 Jan 2024 10:01:03 -0800 (PST)
MIME-Version: 1.0
References: <20240117002459.82A781BA410B@rfcpa.amsl.com>
In-Reply-To: <20240117002459.82A781BA410B@rfcpa.amsl.com>
From: Orie Steele <orie@transmute.industries>
Date: Thu, 25 Jan 2024 12:00:52 -0600
Message-ID: <CAN8C-_JS=aDWin6=050HBzyUtn39utki_d8PwPXvV6espo_Wkw@mail.gmail.com>
To: jose@ietf.org
Content-Type: multipart/alternative; boundary="00000000000076c414060fc8f6fb"
Archived-At: <https://mailarchive.ietf.org/arch/msg/jose/JPnkm_7srRn_Y3EH0mnem1tzrbk>
Subject: Re: [jose] [Technical Errata Reported] RFC7515 (7767)
X-BeenThere: jose@ietf.org
X-Mailman-Version: 2.1.39
Precedence: list
List-Id: Javascript Object Signing and Encryption <jose.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/jose>, <mailto:jose-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/jose/>
List-Post: <mailto:jose@ietf.org>
List-Help: <mailto:jose-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/jose>, <mailto:jose-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 25 Jan 2024 18:01:16 -0000

Dropping all the CC' except for the list.

I agree with the proposed change.

OS

On Thu, Jan 25, 2024 at 8:00 AM RFC Errata System <rfc-editor@rfc-editor.org>
wrote:

> The following errata report has been submitted for RFC7515,
> "JSON Web Signature (JWS)".
>
> --------------------------------------
> You may review the report below and at:
> https://www.rfc-editor.org/errata/eid7767
>
> --------------------------------------
> Type: Technical
> Reported by: Jeffrey Yasskin <jyasskin@google.com>
>
> Section: 6
>
> Original Text
> -------------
> These Header Parameters MUST
>    be integrity protected if the information that they convey is to be
>    utilized in a trust decision; however, if the only information used
>    in the trust decision is a key, these parameters need not be
>    integrity protected, since changing them in a way that causes a
>    different key to be used will cause the validation to fail.
>
> Corrected Text
> --------------
> These Header Parameters MUST
>    be integrity protected if the information that they convey is to be
>    utilized in a trust decision.
>
> Notes
> -----
> See the discussion for https://www.rfc-editor.org/errata/eid7719 at
> https://mailarchive.ietf.org/arch/msg/jose/I3_IuEfFSyiHWap7Pyn1BFAb4QM/.
> The deleted text is incorrect for both signature schemes and encryption
> schemes.
>
> You could consider adding text like "Note that some algorithms allow
> multiple keys to validate or decrypt the same signature or encrypted data."
> to prevent readers from making the same bad assumption as the original RFC
> authors, but it doesn't seem necessary if doing so is contentious.
> Similarly, it's probably ok to simply delete the whole "Original Text" if
> that seems better to the reviewers.
>
> Instructions:
> -------------
> This erratum is currently posted as "Reported". (If it is spam, it
> will be removed shortly by the RFC Production Center.) Please
> use "Reply All" to discuss whether it should be verified or
> rejected. When a decision is reached, the verifying party
> will log in to change the status and edit the report, if necessary.
>
> --------------------------------------
> RFC7515 (draft-ietf-jose-json-web-signature-41)
> --------------------------------------
> Title               : JSON Web Signature (JWS)
> Publication Date    : May 2015
> Author(s)           : M. Jones, J. Bradley, N. Sakimura
> Category            : PROPOSED STANDARD
> Source              : Javascript Object Signing and Encryption
> Area                : Security
> Stream              : IETF
> Verifying Party     : IESG
>
> _______________________________________________
> jose mailing list
> jose@ietf.org
> https://www.ietf.org/mailman/listinfo/jose
>


-- 


ORIE STEELE
Chief Technology Officer
www.transmute.industries

<https://transmute.industries>

v2.23.0 | Report a Bug | By Email