[jose] Comments on draft-ietf-jose-json-web-encryption-10

"Jim Schaad" <ietf@augustcellars.com> Thu, 02 May 2013 21:10 UTC

From: Jim Schaad <ietf@augustcellars.com>
To: draft-ietf-jose-json-web-encryption@tools.ietf.org
Date: Thu, 02 May 2013 14:09:17 -0700
Message-ID: <023b01ce4779$4f48d070$edda7150$@augustcellars.com>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Thread-Index: Ac5HcpTF+I0IMCdbR5Ws7PoJ4pPWOw==
Content-Language: en-us
Cc: jose@ietf.org
Subject: [jose] Comments on draft-ietf-jose-json-web-encryption-10
Precedence: list

Here are a set of comments on the latest draft.

1.  Introduction - The first paragraph should not focus so much on the
compact serialization given that both serializations are merged into this
document.  I would suggest a paragraph on the encryption portion of the
problem followed by a paragraph on the two serialization formats used with
their purposes

2.  After the movement on the CBC_HMAC algorithm, I am not sure that section
3.2 is providing sufficient value for it to be present.  Given that the full
details on it are in an appendix you should consider its removal from here.
You might move a comment on looking in appendix a for completed examples
into section 3 from here

3.  In section 4.1.3 - I would suggest changing the text to "This parameter
MUST be omitted unless required by the algorithm in the "alg" member.  This
header parameter MUST be understood if an algorithm is supported that
requires it."

I have skipped over a number of sections that I knew would be affected by
the outcomes of the interim meeting.

Jim

[jose] Comments on draft-ietf-jose-json-web-encry… Jim Schaad