Re: [jose] #15: Broken examples in JWE / JWS

It may need to be noted that doing /* special magic */ is not something that
a library would ever be able to do.  This implies that the application needs
to know that this is going to be the case and know how to pass in all of the
relevant keys as part of the signature/mac verification process or the
decryption process.

Jim

From: Richard Barnes [mailto:rlb@ipv.sx] 
Sent: Monday, March 25, 2013 2:31 PM
To: Brian Campbell
Cc: Jim Schaad; draft-ietf-jose-json-web-encryption@tools.ietf.org;
jose@ietf.org
Subject: Re: [jose] #15: Broken examples in JWE / JWS

I realize that's the common case.  But the spec doesn't say that.  

All I'm saying is, the spec should REQUIRE that a sender include either a
key indicator, or an indication that something is going on out of band.

--Richard

On Mon, Mar 25, 2013 at 8:15 AM, Brian Campbell <bcampbell@pingidentity.com>
wrote:

/* special magic */ is just some out of band agreement on the key to use or
how to infer it. Which isn't really special or magic. But probably pretty
common.

On Fri, Mar 22, 2013 at 7:37 PM, Richard Barnes <rlb@ipv.sx> wrote:

I've renamed the issue to try to clarify.

You're right that there are alternative ways to locate a key.  But a JOSE
object needs to contain at least one of them, or else the /* special magic
*/ clause applies.  

--Richard

On Fri, Mar 22, 2013 at 9:15 PM, Jim Schaad <ietf@augustcellars.com> wrote:

This may or may not be a flaw in the specification.  However the item you
created in the tracker does not reflect what you have put here.  I think you
would be better served by saying that there is a flaw in the specifications
in that there should be a MUST that some type of key or key reference is
required in a JWS or JWE.

I would note that your example code should be more complex in that it does
not deal with jku or any of the x* methods of referencing keys.

Jim

From: Richard Barnes [mailto:rlb@ipv.sx] 
Sent: Friday, March 22, 2013 4:09 PM
To: Jim Schaad
Cc: draft-ietf-jose-json-web-encryption@tools.ietf.org; jose@ietf.org

Subject: Re: [jose] #15: Broken examples in JWE / JWS

I admit that they are not broken according to the current spec.  However, I
have a lot of trouble figuring out how I would write code to process them.

If "kid" or "jwk" MUST be present to indicate what key I should use, then I
can have deterministic code:

if (/* recognized "kid" or "jwk" value */) { 

    /* use it */

} else {

    /* FAIL.  can't process this object */

}

As the spec stands, I have no idea what to put in that "else" clause.  I'm
clearly not supposed to fail, because the parameters are optional.  But what
else?

if (/* recognized "kid" or "jwk" value */) { 

    /* use it */

} else {

    /* insert special magic here */

}

This is actually what SPI is supposed to clear up.  SPI would provide an
explicit third branch for the special magic to live in.

if (/* recognized "kid" or "jwk" value */) { 

    /* use it */

} else if (/* recognized SPI value */) {

    /* process using stored parameters */

} else {

    /* FAIL.  can't process this object */

}

But without the concept of SPI, the spec is broken because of the
non-determinism noted above.

--Richard

On Fri, Mar 22, 2013 at 6:13 PM, Jim Schaad <ietf@augustcellars.com> wrote:

My inclination is that this response is correct.

What make you think that the key or key reference is required and cannot be
implied?

Jim

> -----Original Message-----
> From: jose-bounces@ietf.org [mailto:jose-bounces@ietf.org] On Behalf Of
> jose issue tracker
> Sent: Friday, March 22, 2013 2:37 PM
> To: draft-ietf-jose-json-web-encryption@tools.ietf.org;
ignisvulpis@gmail.com
> Cc: jose@ietf.org
> Subject: Re: [jose] #15: Broken examples in JWE / JWS
>
> #15: Broken examples in JWE / JWS
>
>
> Comment (by ignisvulpis@gmail.com):
>
>  I think this is not an issue. The examples are NOT broken and they do not
> need a fix.
>  I suggest to close this ticket.
>  The draft should definitely not make these illegal. These objects are
perfect
> examples for a valid JWS/JWE.
>
> --
> -------------------------+----------------------------------------------

> -------------------------+---

>  Reporter:  rlb@ipv.sx   |       Owner:  draft-ietf-jose-json-web-
>      Type:  defect       |  encryption@tools.ietf.org
>  Priority:  minor        |      Status:  new
> Component:  json-web-    |   Milestone:
>   encryption             |     Version:
>  Severity:  -            |  Resolution:
>  Keywords:               |
> -------------------------+----------------------------------------------

> -------------------------+---

>
> Ticket URL: <http://trac.tools.ietf.org/wg/jose/trac/ticket/15#comment:1>
> jose <http://tools.ietf.org/jose/>
>
> _______________________________________________
> jose mailing list
> jose@ietf.org
> https://www.ietf.org/mailman/listinfo/jose

_______________________________________________
jose mailing list
jose@ietf.org
https://www.ietf.org/mailman/listinfo/jose