Re: [jose] Stephen Farrell's Discuss on draft-ietf-jose-json-web-key-33: (with DISCUSS and COMMENT)

Mike Jones <Michael.Jones@microsoft.com> Tue, 07 October 2014 01:12 UTC

Return-Path: <Michael.Jones@microsoft.com>
X-Original-To: jose@ietfa.amsl.com
Delivered-To: jose@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D98DA1A90F3; Mon, 6 Oct 2014 18:12:55 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.902
X-Spam-Level:
X-Spam-Status: No, score=-1.902 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PVmPvqYf01sg; Mon, 6 Oct 2014 18:12:52 -0700 (PDT)
Received: from na01-bl2-obe.outbound.protection.outlook.com (mail-bl2on0139.outbound.protection.outlook.com [65.55.169.139]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 651261A0242; Mon, 6 Oct 2014 18:12:52 -0700 (PDT)
Received: from DM2PR03CA0049.namprd03.prod.outlook.com (10.141.96.48) by DM2PR0301MB1216.namprd03.prod.outlook.com (25.160.219.17) with Microsoft SMTP Server (TLS) id 15.0.1044.10; Tue, 7 Oct 2014 01:12:50 +0000
Received: from BN1BFFO11FD035.protection.gbl (2a01:111:f400:7c10::1:158) by DM2PR03CA0049.outlook.office365.com (2a01:111:e400:2428::48) with Microsoft SMTP Server (TLS) id 15.0.1044.10 via Frontend Transport; Tue, 7 Oct 2014 01:12:50 +0000
Received: from mail.microsoft.com (131.107.125.37) by BN1BFFO11FD035.mail.protection.outlook.com (10.58.144.98) with Microsoft SMTP Server (TLS) id 15.0.1039.16 via Frontend Transport; Tue, 7 Oct 2014 01:12:49 +0000
Received: from TK5EX14MBXC286.redmond.corp.microsoft.com ([169.254.1.93]) by TK5EX14HUBC102.redmond.corp.microsoft.com ([157.54.7.154]) with mapi id 14.03.0210.003; Tue, 7 Oct 2014 01:12:19 +0000
From: Mike Jones <Michael.Jones@microsoft.com>
To: Stephen Farrell <stephen.farrell@cs.tcd.ie>, Jim Schaad <ietf@augustcellars.com>, 'Ted Lemon' <Ted.Lemon@nominum.com>
Thread-Topic: [jose] Stephen Farrell's Discuss on draft-ietf-jose-json-web-key-33: (with DISCUSS and COMMENT)
Thread-Index: AQHP3jI0y2YQdh1++ku2NamIZ5KlrpwiPARQgAFPwQCAAAGVAIAADBaAgAAB+ACAAAMNgIAAAq0AgAA3FFA=
Date: Tue, 7 Oct 2014 01:12:18 +0000
Message-ID: <4E1F6AAD24975D4BA5B16804296739439BAF2783@TK5EX14MBXC286.redmond.corp.microsoft.com>
References: <20141002111501.6046.52416.idtracker@ietfa.amsl.com> <4E1F6AAD24975D4BA5B16804296739439BAF0C1E@TK5EX14MBXC286.redmond.corp.microsoft.com> <00c601cfe1a4$15d32900$41797b00$@augustcellars.com> <7ABF79CB-61C8-490B-A727-465530222F0B@nominum.com> <00dd01cfe1aa$eba7db10$c2f79130$@augustcellars.com> <54330888.4090605@cs.tcd.ie> <00f101cfe1ad$6dc9fea0$495dfbe0$@augustcellars.com> <54330D56.507@cs.tcd.ie>
In-Reply-To: <54330D56.507@cs.tcd.ie>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-originating-ip: [157.54.51.35]
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: base64
MIME-Version: 1.0
X-EOPAttributedMessage: 0
X-Forefront-Antispam-Report: CIP:131.107.125.37; CTRY:US; IPV:CAL; IPV:NLI; IPV:NLI; EFV:NLI; SFV:NSPM; SFS:(10019020)(6009001)(438002)(51704005)(199003)(189002)(76482002)(86362001)(230783001)(92726001)(92566001)(33656002)(99396003)(120916001)(64706001)(47776003)(20776003)(81156004)(106466001)(21056001)(50466002)(106116001)(80022003)(46102003)(26826002)(86612001)(93886004)(97736003)(85306004)(23676002)(104016003)(77096002)(85806002)(85852003)(44976005)(6806004)(68736004)(50986999)(84676001)(87936001)(2656002)(76176999)(95666004)(54356999)(107046002)(66066001)(69596002)(55846006)(4396001)(31966008); DIR:OUT; SFP:1102; SCL:1; SRVR:DM2PR0301MB1216; H:mail.microsoft.com; FPR:; MLV:ovrnspm; PTR:InfoDomainNonexistent; A:1; MX:1; LANG:en;
X-Microsoft-Antispam: UriScan:;
X-Microsoft-Antispam: BCL:0;PCL:0;RULEID:;SRVR:DM2PR0301MB1216;
X-O365ENT-EOP-Header: Message processed by - O365_ENT: Allow from ranges (Engineering ONLY)
X-Forefront-PRVS: 035748864E
Received-SPF: Pass (protection.outlook.com: domain of microsoft.com designates 131.107.125.37 as permitted sender) receiver=protection.outlook.com; client-ip=131.107.125.37; helo=mail.microsoft.com;
Authentication-Results: spf=pass (sender IP is 131.107.125.37) smtp.mailfrom=Michael.Jones@microsoft.com;
X-OriginatorOrg: microsoft.onmicrosoft.com
Archived-At: http://mailarchive.ietf.org/arch/msg/jose/YluIBv8psJzxw2R1fioonR1Xf08
Cc: "jose-chairs@tools.ietf.org" <jose-chairs@tools.ietf.org>, "draft-ietf-jose-json-web-key@tools.ietf.org" <draft-ietf-jose-json-web-key@tools.ietf.org>, 'The IESG' <iesg@ietf.org>, "jose@ietf.org" <jose@ietf.org>
Subject: Re: [jose] Stephen Farrell's Discuss on draft-ietf-jose-json-web-key-33: (with DISCUSS and COMMENT)
X-BeenThere: jose@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Javascript Object Signing and Encryption <jose.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/jose>, <mailto:jose-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/jose/>
List-Post: <mailto:jose@ietf.org>
List-Help: <mailto:jose-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/jose>, <mailto:jose-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 07 Oct 2014 01:12:56 -0000

> >>>>> I worry that if we starting providing guidance to DNS names, then
> >>>>> we need to worry about the I18N implications.  I don't remember if
> >>>>> these are both case sensitive and easy to do the case conversion
> >>>>> on.
> >>>>
> >>>> Isn't this a solved problem?   You convert to the unicode
> >>>> presentation and then convert to the canonical case as defined in
> >>>> the unicode standard.
> >>> The
> >>>> worst case scenario is that you encounter some script where this
> >>>> rule
> >>> doesn't
> >>>> work, and that script is then in the position that all scripts are
> >>>> in now.
> >>>
> >>> It may be it is, however this makes an assumption that clients are
> >>> up on how to do this.  I.e. that JavaScript is going to do it right
> >>> when I do a strlower function on a string.  I don't know that this
> >>> is really the case. I would hope so but am unsure.
> >>
> >> So we're talking about key ids here. In most case where those would
> >> use DNS names, the code that creates the key id would know what its
> >> doing and dumber code would be presented with the key id and would
> >> not have to do the tolower().
> >>
> >> So I would say its safe to add something like "When creating a key
> >> id, if the code doing so is aware that it is dealing with a DNS name,
> >> then that code should tolower() the DNS name before including those
> >> bytes in the key id."
> >
> > Yes, but if that is the case, then why does it need to be lower-cased
> > at all?  If I say my key id is "JimSchaad.foobar" and that is my DNS
> > address why does it need to be lowercased? Jim
> 
> Because there will be cases where two different implementations with code try
> to create the same key id from its components and get it wrong otherwise. Not
> all cases, but some.
> 
> S.

All of this is making me think that saying anything specifically about the use of DNS names in Key IDs is opening up a can of worms - particularly I18N worms. ;-)

In my initial response, I'd proposed that we add more generic text like the following.  Would that work for you, Stephen?

"If case-insensitive values, such as DNS names, are included in "kid" values, then the application specifying their inclusion needs to define a canonical case-sensitive representation to use for the case-insensitive portions inside the "kid", such as lowercasing them."

				-- Mike