Re: [jose] #17: add 'aud' and 'iss' to 4.1 Reserved Header Parameter Names

Mike,

I want to make sure that I understand how the registry is going to work.
After I get an answer I will go back and review the document to make sure
that it is both clear and consistent with your response.

It is clear that any document (not just an IETF document) can create a new
entry in the header registry.  Once this has been done there are two
possible results:

1.  The resulting registration is for a specific protocol - thus if the JWT
document registers iss and aud they would be specific for to the JWT
documents or
2.  The resulting registration is permitted for any protocol - thus the JWT
document would be required to provide clear documentation about how the iss
and aud header fields would operate for any potential new protocol that
wanted to use these header fields.

I think that both you and the WG believe that the second statement is
correct.  This is just a verification for me personally.

Jim

> -----Original Message-----
> From: jose-bounces@ietf.org [mailto:jose-bounces@ietf.org] On Behalf Of
> Mike Jones
> Sent: Thursday, April 04, 2013 4:04 PM
> To: Dick Hardt
> Cc: draft-ietf-jose-json-web-encryption@tools.ietf.org; jose@ietf.org
> Subject: Re: [jose] #17: add 'aud' and 'iss' to 4.1 Reserved Header
Parameter
> Names
> 
> I think it's better for three reasons.  First, I think it's better to
reserve the
> names and define the new processing rules in the document where they're
> defined - the JWT spec.
> 
> Second, the "iss" and "aud" header values aren't meaningful in JWEs in the
> general case - only in JWEs whose message is a JWT Claims Set.  That's a
> scoping argument that they shouldn't be defined in the JWE spec.
> 
> Third, as is normal for IETF specs, the "one place to look for reserved
JWE
> header names" is the IANA registry for those names.  Yes, the JWE spec
> reserves an initial set of names, but it won't be the only spec to reserve
> header parameter names, and so to see the full list, developers have to
> consult the registry.
> 
> 				-- Mike
> 
> P.S.  There's already an example of the JWT spec reserving names in a
registry
> defined by the JWS spec.  See
http://tools.ietf.org/html/draft-ietf-oauth-json-
> web-token-06#section-9.3.1.  Reserving header parameter names in the JSON
> Web Signature and Encryption Header Parameters Registry established in JWS
> (see
http://tools.ietf.org/html/draft-ietf-jose-json-web-signature-08#section-
> 7.1.1) would be done in an analogous manner.
> 
> -----Original Message-----
> From: jose-bounces@ietf.org [mailto:jose-bounces@ietf.org] On Behalf Of
> Dick Hardt
> Sent: Thursday, April 04, 2013 1:10 PM
> To: Mike Jones
> Cc: draft-ietf-jose-json-web-encryption@tools.ietf.org; jose@ietf.org
> Subject: Re: [jose] #17: add 'aud' and 'iss' to 4.1 Reserved Header
Parameter
> Names
> 
> 
> On Apr 4, 2013, at 9:27 AM, Mike Jones <Michael.Jones@microsoft.com>
> wrote:
> 
> > JWT defines "aud" and "iss" and reserves them as claim names but not as
> JWE header parameter names, nor does it currently specify their usage in
that
> location.  My point is that I think the best way to accomplish what you're
> asking for is to have the JWT spec also reserve these as JWE header
> parameter names and define the semantics and processing rules associated
> with using them in that location.
> 
> Repeating that you think it is "best" is not educating me on *why* you
think it
> is "best"!
> 
> The other reserved JWE header parameter names are not reserved in JWT.
> The current list of reserved JWE header parameter names are in the JWE
> document. Having another place to look for what names are reserved looks
> inefficient and error prone unless ALL reserved JWE header parameter
> names are listed in JWT.
> 
> 
> _______________________________________________
> jose mailing list
> jose@ietf.org
> https://www.ietf.org/mailman/listinfo/jose
> _______________________________________________
> jose mailing list
> jose@ietf.org
> https://www.ietf.org/mailman/listinfo/jose