Re: [jose] x5c, x5u, x5t don't apply to all key types
Brian Campbell <bcampbell@pingidentity.com> Tue, 30 July 2013 10:16 UTC
Return-Path: <bcampbell@pingidentity.com>
X-Original-To: jose@ietfa.amsl.com
Delivered-To: jose@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E92F021E808B for <jose@ietfa.amsl.com>; Tue, 30 Jul 2013 03:16:28 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -5.717
X-Spam-Level:
X-Spam-Status: No, score=-5.717 tagged_above=-999 required=5 tests=[AWL=0.259, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-4]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id X9M8j4y54+up for <jose@ietfa.amsl.com>; Tue, 30 Jul 2013 03:16:23 -0700 (PDT)
Received: from na3sys009aog106.obsmtp.com (na3sys009aog106.obsmtp.com [74.125.149.77]) by ietfa.amsl.com (Postfix) with ESMTP id 75FDC21F8956 for <jose@ietf.org>; Tue, 30 Jul 2013 03:16:23 -0700 (PDT)
Received: from mail-oa0-f45.google.com ([209.85.219.45]) (using TLSv1) by na3sys009aob106.postini.com ([74.125.148.12]) with SMTP ID DSNKUfeSdQTkEjVOjyqnVVyuNv+Uu0qvZ/x0@postini.com; Tue, 30 Jul 2013 03:16:23 PDT
Received: by mail-oa0-f45.google.com with SMTP id m1so5461234oag.18 for <jose@ietf.org>; Tue, 30 Jul 2013 03:16:21 -0700 (PDT)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type:x-gm-message-state; bh=LXD7TMh3k8/r6m3aHiQTZadG8YX/t2CQ9qsmnpx3Kmg=; b=nReoF4avmLXOnpwssC5cSGzeDW2QOhNZW+HO5/HRegrKuc3iTqy81s/gZD06RxuD8N +2HgSV+mo5hWT+A4gjlwUQc/gmcAtTOWbqQ7zpVNamHxLKULdqkDK6z4MOXG1K25G3aw VTuBCtv+jObLUjywLwYpSdtjzamubYGtJUuwgjd5z1kWEf7AuYrXPeCkAqlyg4D/OxLS ANeqkk+AgLE/T3qxJFHxnK0TY9Fsi7veGoMaoC/lg4/NG9fFusFrmy77ZL9MCGyFrh4l yv/K2t3BQyatB80yCdDagsndu+mtl92HBvhz1mGNf3UC49XbZ4kaKN/FzKElqbQ1j2FF gc7w==
X-Received: by 10.50.44.98 with SMTP id d2mr77989igm.28.1375179381430; Tue, 30 Jul 2013 03:16:21 -0700 (PDT)
X-Received: by 10.50.44.98 with SMTP id d2mr77987igm.28.1375179381308; Tue, 30 Jul 2013 03:16:21 -0700 (PDT)
MIME-Version: 1.0
Received: by 10.64.41.34 with HTTP; Tue, 30 Jul 2013 03:15:50 -0700 (PDT)
In-Reply-To: <4E1F6AAD24975D4BA5B16804296739436B730979@TK5EX14MBXC284.redmond.corp.microsoft.com>
References: <4E1F6AAD24975D4BA5B16804296739436B730979@TK5EX14MBXC284.redmond.corp.microsoft.com>
From: Brian Campbell <bcampbell@pingidentity.com>
Date: Tue, 30 Jul 2013 12:15:50 +0200
Message-ID: <CA+k3eCQVVZq67hOAS35tkERSJaZ0-VQfxHezvraLsScOj9hqCA@mail.gmail.com>
To: Mike Jones <Michael.Jones@microsoft.com>
Content-Type: multipart/alternative; boundary="e89a8f839371869a1804e2b7e624"
X-Gm-Message-State: ALoCoQnAeXManZZb2bGgKMRhCkeTe/x30TVb9Z/5Zqm6Vck/yDKeXvdYGoK29YItxo/wRWA+2ndOU83pOpbIGtVhl4gobTdSQpLC1A98KjKoSHmyY6qK9mwvgI3vvj7L6M5JPC4uydY9
Cc: "jose@ietf.org" <jose@ietf.org>
Subject: Re: [jose] x5c, x5u, x5t don't apply to all key types
X-BeenThere: jose@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: Javascript Object Signing and Encryption <jose.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/jose>, <mailto:jose-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/jose>
List-Post: <mailto:jose@ietf.org>
List-Help: <mailto:jose-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/jose>, <mailto:jose-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 30 Jul 2013 10:16:29 -0000
On Tue, Jul 30, 2013 at 11:08 AM, Mike Jones <Michael.Jones@microsoft.com>wrote: > Draft -14 now says “members that are common to multiple key types”. > WFM. Thanks. > And the incorrectly numbered sections are actually gone. > Actually, 3.3.3 still looks problematic, "JWK Parameters for Symmetric Keys" lines up as though it's part of RSA. 5 <http://tools.ietf.org/html/draft-ietf-jose-json-web-algorithms-14#section-5>. Cryptographic Algorithms for JWK . . . . . . . . . . . . . . . 33 <http://tools.ietf.org/html/draft-ietf-jose-json-web-algorithms-14#page-33> 5.1 <http://tools.ietf.org/html/draft-ietf-jose-json-web-algorithms-14#section-5.1>. "kty" (Key Type) Parameter Values for JWK . . . . . . . . 33 <http://tools.ietf.org/html/draft-ietf-jose-json-web-algorithms-14#page-33> 5.2 <http://tools.ietf.org/html/draft-ietf-jose-json-web-algorithms-14#section-5.2>. JWK Parameters for Elliptic Curve Keys . . . . . . . . . . 33 <http://tools.ietf.org/html/draft-ietf-jose-json-web-algorithms-14#page-33> 5.2.1 <http://tools.ietf.org/html/draft-ietf-jose-json-web-algorithms-14#section-5.2.1>. JWK Parameters for Elliptic Curve Public Keys . . . . 33 <http://tools.ietf.org/html/draft-ietf-jose-json-web-algorithms-14#page-33> [...] 5.2.2 <http://tools.ietf.org/html/draft-ietf-jose-json-web-algorithms-14#section-5.2.2>. JWK Parameters for Elliptic Curve Private Keys . . . . 34 <http://tools.ietf.org/html/draft-ietf-jose-json-web-algorithms-14#page-34> 5.2.2.1 <http://tools.ietf.org/html/draft-ietf-jose-json-web-algorithms-14#section-5.2.2.1>. "d" (ECC Private Key) Parameter . . . . . . . . . 34 <http://tools.ietf.org/html/draft-ietf-jose-json-web-algorithms-14#page-34> 5.3 <http://tools.ietf.org/html/draft-ietf-jose-json-web-algorithms-14#section-5.3>. JWK Parameters for RSA Keys . . . . . . . . . . . . . . . 35 <http://tools.ietf.org/html/draft-ietf-jose-json-web-algorithms-14#page-35> 5.3.1 <http://tools.ietf.org/html/draft-ietf-jose-json-web-algorithms-14#section-5.3.1>. JWK Parameters for RSA Public Keys . . . . . . . . . . 35 <http://tools.ietf.org/html/draft-ietf-jose-json-web-algorithms-14#page-35> [...] 5.3.2 <http://tools.ietf.org/html/draft-ietf-jose-json-web-algorithms-14#section-5.3.2>. JWK Parameters for RSA Private Keys . . . . . . . . . 35 <http://tools.ietf.org/html/draft-ietf-jose-json-web-algorithms-14#page-35> [...] 5.3.3 <http://tools.ietf.org/html/draft-ietf-jose-json-web-algorithms-14#section-5.3.3>. JWK Parameters for Symmetric Keys . . . . . . . . . . 37 <http://tools.ietf.org/html/draft-ietf-jose-json-web-algorithms-14#page-37> 5.3.3.1 <http://tools.ietf.org/html/draft-ietf-jose-json-web-algorithms-14#section-5.3.3.1>. "k" (Key Value) Parameter . . . . . . . . . . . . 37 <http://tools.ietf.org/html/draft-ietf-jose-json-web-algorithms-14#page-37> > > *From:* Mike Jones > *Sent:* Wednesday, July 17, 2013 1:55 PM > *To:* 'Brian Campbell'; jose@ietf.org > *Subject:* RE: [jose] x5c, x5u, x5t don't apply to all key types**** > > ** ** > > Thanks for noticing this. How about “members that are common to all > public key types”?**** > > ** ** > > You’re right about the section numbering. I’ll fix that.**** > > ** ** > > Thanks again,* > *** > > -- Mike**** > > ** ** > > *From:* jose-bounces@ietf.org [mailto:jose-bounces@ietf.org<jose-bounces@ietf.org>] > *On Behalf Of *Brian Campbell > *Sent:* Wednesday, July 17, 2013 12:34 PM > *To:* jose@ietf.org > *Subject:* [jose] x5c, x5u, x5t don't apply to all key types**** > > ** ** > > Section 3 of JWK [1] defines "members that are common to all key types" > and includes among those members x5c, x5u and x5t. However, the x5X > parameters are relevant only for half the key types defined in JWA - they > don't really make sense for "oct" [2] or "PBKDF2" [3]. **** > > Not sure the best way to address this but it seems kind of awkward as it > is. Maybe move them into the EC and RSA type definitions (or something > common to both) or somehow add some qualifying text saying that they can > only be used with key types utilizing public keys?**** > > As I was looking up the URLs below I noticed that the section alignment in > section 5 of JWA is a little off. I think 5.3.3 and 5.3.4 should probably > be 5.4 and 5.5 respectively. Right now they line up as though they were > part of the RSA key type.**** > > ** ** > > [1] http://tools.ietf.org/html/draft-ietf-jose-json-web-key-13#section-3 > [2] > http://tools.ietf.org/html/draft-ietf-jose-json-web-algorithms-13#section-5.3.3 > [3] > http://tools.ietf.org/html/draft-ietf-jose-json-web-algorithms-13#section-5.3.4 > **** >
- [jose] x5c, x5u, x5t don't apply to all key types Brian Campbell
- Re: [jose] x5c, x5u, x5t don't apply to all key t… Mike Jones
- Re: [jose] x5c, x5u, x5t don't apply to all key t… Brian Campbell
- Re: [jose] x5c, x5u, x5t don't apply to all key t… Mike Jones
- Re: [jose] x5c, x5u, x5t don't apply to all key t… Brian Campbell
- Re: [jose] x5c, x5u, x5t don't apply to all key t… Mike Jones