Re: [jose] #17: add 'aud' and 'iss' to 4.1 Reserved Header Parameter Names

[Mike Jones <[e-mail]>]

Responding to your "unsettled" remark, I suspect most people are fine with having the "aud" and "iss" be claims in the JWT where they normally are.  Yes, you have to decrypt the token to get these claim values, but if you're going to use the token, you'll have to do that anyway.

I don't think it's clear to most people what problem is being solved by potentially these fields to be present in a different location.  Without a compelling use case, this just seems like more to implement without a clear benefit of doing so.

				-- Mike

-----Original Message-----
From: Dick Hardt [mailto:[e-mail]] 
Sent: Wednesday, April 03, 2013 9:29 PM
To: jose issue tracker
Cc: [e-mail]; Mike Jones; [e-mail]; [e-mail]
Subject: Re: [jose] #17: add 'aud' and 'iss' to 4.1 Reserved Header Parameter Names

Actually, Mike was suggesting that the issue be moved to the JWT WG. 

I'll settle with the JWE spec pointing to an IANA registry. Speaking as an implementer, if there is a list of reserved names in the spec, I'm likely to think that is all of them.

I'm a little unsettled that no one else has had any feedback on having 'aud' and 'iss' in the JWE header. Is my implementation the only that has that requirement? 

-- Dick

On Apr 3, 2013, at 8:57 PM, "jose issue tracker" <[e-mail]> wrote:

> #17: add 'aud' and 'iss' to 4.1 Reserved Header Parameter Names
> 
> 
> Comment (by [e-mail]):
> 
> I agree with Mike that these don't really belong in the core JWE/JWS 
> specs.
> 
> I would suggest we address this issue more generally, by creating an 
> IANA registry of reserved parameter names, with a fairly liberal 
> inclusion policy.  That registry could have a field to indicate 
> whether JOSE implementations are REQUIRED to support a given parameter 
> (MTI parameters).  (Note that this is different from whether a JOSE 
> object is REQUIRED to contain a parameter.)  Perhaps we could have 
> optional parameters under a fairly liberal policy (e.g., Specification 
> Required), with a higher bar for MTI parameters (e.g., Standards Action).
> 
> If we set up the registry in this way, then Dick could write a short 
> Informational document that would register these fields.
> 
> --
> -------------------------+--------------------------------------------
> -------------------------+-----
> Reporter:               |       Owner:  draft-ietf-jose-json-web-
>  [e-mail]   |  [e-mail]
>     Type:  enhancement  |      Status:  new
> Priority:  major        |   Milestone:
> Component:  json-web-    |     Version:
>  encryption             |  Resolution:
> Severity:  -            |
> Keywords:               |
> -------------------------+--------------------------------------------
> -------------------------+-----
> 
> Ticket URL: 
> <http://trac.tools.ietf.org/wg/jose/trac/ticket/17#comment:2>
> jose <http://tools.ietf.org/jose/>
> 
> _______________________________________________
> jose mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/jose