Re: [jose] #27: member names MUST be unique needs additional text

<no hat>

I consider myself to be reasonably competent in both English and Technical English.  I have no idea what I am supposed to be doing to deal with the text below.  Does this mean that I need to write an independent parser?  What about cases where it is coming in on a stream and I don't get to see the data before the parse occurs?  How are they interpreted differently?  What exactly is this supposed to be addressing.  Much of this could be skipped when we said don't do it.  Since this is no longer a viable statement due to the state of parsers, we need to be more explicit and say what is going on.

No I don't consider the suggested text to be adequate.

> -----Original Message-----
> From: jose-bounces@ietf.org [mailto:jose-bounces@ietf.org] On Behalf Of
> jose issue tracker
> Sent: Tuesday, June 25, 2013 5:41 PM
> To: draft-ietf-jose-json-web-signature@tools.ietf.org;
> michael.jones@microsoft.com
> Cc: jose@ietf.org
> Subject: Re: [jose] #27: member names MUST be unique needs additional text
> 
> #27: member names MUST be unique needs additional text
> 
> 
> Comment (by michael.jones@microsoft.com):
> 
>  The JWS draft currently says:
> 
>          The Header Parameter Names within the JWS Header MUST be unique;
>          JWSs with duplicate Header Parameter Names MUST be rejected.
> 
>  How about changing this to:
> 
>          The Header Parameter Names within the JWS Header MUST be unique;
>          JWSs with duplicate Header Parameter Names MUST be rejected.
>          This is necessary to prevent attacks in which the same JWS might  be
> interpreted
>          in different ways by different implementations and to prevent  attackers
>          from hiding extra content in duplicate member values.
>          If the platform s JSON parser does not reject input with duplicate
> member names,
>          the input will first need to be separately parsed to reject these  invalid
> inputs
>          before using the platform s parser.
> 
> --
> -------------------------+----------------------------------------------
> -------------------------+---
>  Reporter:               |       Owner:  draft-ietf-jose-json-web-
>   ietf@augustcellars.com |  signature@tools.ietf.org
>      Type:  defect       |      Status:  new
>  Priority:  major        |   Milestone:
> Component:  json-web-    |     Version:
>   signature              |  Resolution:
>  Severity:  -            |
>  Keywords:               |
> -------------------------+----------------------------------------------
> -------------------------+---
> 
> Ticket URL: <http://trac.tools.ietf.org/wg/jose/trac/ticket/27#comment:1>
> jose <http://tools.ietf.org/jose/>
> 
> _______________________________________________
> jose mailing list
> jose@ietf.org
> https://www.ietf.org/mailman/listinfo/jose