Re: [jose] Header criticality -- hidden consensus?
Richard Barnes <rlb@ipv.sx> Sat, 09 February 2013 00:08 UTC
Return-Path: <rlb@ipv.sx>
X-Original-To: jose@ietfa.amsl.com
Delivered-To: jose@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1186521F8C2B for <jose@ietfa.amsl.com>; Fri, 8 Feb 2013 16:08:43 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: 0.48
X-Spam-Level:
X-Spam-Status: No, score=0.48 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FH_RELAY_NODNS=1.451, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, RCVD_IN_PBL=0.905, RDNS_NONE=0.1]
Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8151cEP-ZILf for <jose@ietfa.amsl.com>; Fri, 8 Feb 2013 16:08:42 -0800 (PST)
Received: from mail-la0-x229.google.com (la-in-x0229.1e100.net [IPv6:2a00:1450:4010:c03::229]) by ietfa.amsl.com (Postfix) with ESMTP id 875C521F8BE2 for <jose@ietf.org>; Fri, 8 Feb 2013 16:08:41 -0800 (PST)
Received: by mail-la0-f41.google.com with SMTP id fo12so4355687lab.0 for <jose@ietf.org>; Fri, 08 Feb 2013 16:08:40 -0800 (PST)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:x-received:x-originating-ip:in-reply-to:references :date:message-id:subject:from:to:cc:content-type:x-gm-message-state; bh=zhXvV9igfhMrlW0ap3hA2KJZCZw6mM1Fw4TseSx+ykY=; b=QGKLbLESYTYcQ8DYv9md555U/+JvEnSG/Am+TBd/kLXVLADTsc8NAawDK7497yn54w dVXSkrmRTfdfVncpYJY3Fn1uqlH/I0kYgR5KMDO2tFrffM3MJCHzwEGkPBS7Vu+VMvPs 0Q2aaHqOU1J8SC/jX++AL9hHV6N2oJPEwDTmCG/t1QX0WL71Oia9tBM6WZLwQq7uYqjh LdBuRDx4coFSFWTI/8jjNaBENosrNzfGV5ThwZqwGimzDWaoPNwRE1eHtn+V77v3ha5D a8lTS4i9RSCMY0GlPtl2FJkpHDArs0sT3DnG4h+PfloBpm0EqkRM9xyEMfhj30G4gOAu o8wQ==
MIME-Version: 1.0
X-Received: by 10.112.42.5 with SMTP id j5mr2898910lbl.37.1360368520109; Fri, 08 Feb 2013 16:08:40 -0800 (PST)
Received: by 10.112.147.164 with HTTP; Fri, 8 Feb 2013 16:08:39 -0800 (PST)
X-Originating-IP: [174.252.108.244]
In-Reply-To: <4E1F6AAD24975D4BA5B168042967394367421FAC@TK5EX14MBXC284.redmond.corp.microsoft.com>
References: <4E1F6AAD24975D4BA5B168042967394367421FAC@TK5EX14MBXC284.redmond.corp.microsoft.com>
Date: Fri, 08 Feb 2013 19:08:39 -0500
Message-ID: <CAL02cgTTBueQ-_q1Soam5Z2cy_+pUHpcw6RjS+e7dZ=hmbsxzw@mail.gmail.com>
From: Richard Barnes <rlb@ipv.sx>
To: Mike Jones <Michael.Jones@microsoft.com>
Content-Type: multipart/alternative; boundary="e0cb4efe3572679f2304d53f7a2c"
X-Gm-Message-State: ALoCoQlb91HMn3KxXCYAhwpGsX84VgxRuMFSONSN4ArripVcEs1eqMo8XTHWYNe1OOEqJ3roUnfA
Cc: Brian Campbell <bcampbell@pingidentity.com>, "jose@ietf.org" <jose@ietf.org>
Subject: Re: [jose] Header criticality -- hidden consensus?
X-BeenThere: jose@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: Javascript Object Signing and Encryption <jose.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/jose>, <mailto:jose-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/jose>
List-Post: <mailto:jose@ietf.org>
List-Help: <mailto:jose-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/jose>, <mailto:jose-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 09 Feb 2013 00:08:43 -0000
Thanks for the revisions, but the absolute numbers really don't matter. The important feature is that nobody voted Yes on 1 and No on 2. On Friday, February 8, 2013, Mike Jones wrote: > FWIW, I believe that John Bradley’s, Ryo Ito’s, and Dick Hardt’s > responses are also incorrectly tallied below, the caveats on Breno de > Medeiros’ “B” are missing, and Chuck Mortimore’s response is missing. I > believe that their responses were:**** > > ** ** > > N Y A Campbell **** > > N Y A Bradley **** > > N Y A Ito **** > > Y Y C Hardt (Dick changed his answer on 3)**** > > Y Y B* de Medeiros (*B if the new header can be > omitted, so that 3-component JWTs are still valid. I don't support this > option if backwards-incompatible.)**** > > Y Y A Mortimore **** > > ** ** > > By my count, this would bring the answers to date on the first question to: > **** > > ** ** > > 16 “yes”**** > > 10 “no”**** > > ** ** > > FWIW**** > > ** ** > > And yes, the IETF doesn’t vote… J I’m sure we’ll have an interesting > discussion after the polling period is over on Monday. As for me, I have > been actively thinking about how to meet everyone’s perceived needs, but > will hold off on that until after Monday.**** > > ** ** > > Take care, > **** > > -- Mike*** > * > > ** ** > > *From:* jose-bounces@ietf.org <javascript:_e({}, 'cvml', > 'jose-bounces@ietf.org');> [mailto:jose-bounces@ietf.org<javascript:_e({}, 'cvml', 'jose-bounces@ietf.org');>] > *On Behalf Of *Brian Campbell > *Sent:* Friday, February 08, 2013 3:35 PM > *To:* Richard Barnes > *Cc:* jose@ietf.org <javascript:_e({}, 'cvml', 'jose@ietf.org');> > *Subject:* Re: [jose] Header criticality -- hidden consensus?**** > > ** ** > > FWIW, I didn't see my name on the tabulation but I did 'vote' > http://www.ietf.org/mail-archive/web/jose/current/msg01461.html**** > > ** ** > > On Fri, Feb 8, 2013 at 4:11 PM, Richard Barnes <rlb@ipv.sx<javascript:_e({}, 'cvml', 'rlb@ipv.sx');>> > wrote:**** > > We're 24 votes into the header criticality poll, so I thought I would go > ahead and take a look at how the results are shaping up. My initial > tabulation is below. The result on the FIRST POLL (the main one) is as > follows:**** > > ** ** > > No: 10**** > > Yes: 14**** > > ** ** > > What I find striking, however, is that every single person that voted > "Yes" on the FIRST POLL also voted "Yes" on the SECOND POLL. So nobody who > thinks that all headers should be critical thinks that a JOSE library > should actually be required to enforce this constraint. And that means > that enforcing that all headers are supported cannot be a MUST according to > RFC 2119.**** > > ** ** > > So I wonder if there's consensus to remove the following text from JWE and > JWS:**** > > -----BEGIN-JWE-----**** > > 4. The resulting JWE Header MUST be validated to only include**** > > parameters and values whose syntax and semantics are both**** > > understood and supported.**** > > -----END-JWE-----**** > > -----BEGIN-JWS-----**** > > 4. The resulting JWS Header MUST be validated to only include**** > > parameters and values whose syntax and semantics are both**** > > understood and supported.**** > > -----END-JWS-----**** > > ** ** > > Otherewise, a JOSE library conforming to these specifications would be > REQUIRED (a synonym to MUST in 2119) to reject a JWE/JWS that contains an > unknown header, contradicting all those "Yes" votes on the SECOND POLL.*** > * > > ** ** > > --Richard**** > > ** ** > > ** ** > > ** ** > > -----BEGIN-Tabulation-----**** > > 1 2 3 Name: **** > > N - - Bradley **** > > N - - Ito **** > > N N A Yee **** > > N N B Barnes **** > > N N B Rescorla **** > > N N C Manger **** > > N N C Octman **** > > N Y A Fletcher **** > > N Y A Miller **** > > N Y A Sakimura **** > > Y Y - D'Agostino **** > > Y Y A Biering **** > > Y Y A Brault **** > > Y Y A Hedberg **** > > Y Y A Jay **** > > Y Y A Jones **** > > Y Y A Marais **** > > Y Y A Nadalin **** > > Y Y A Nara **** > > Y Y A Nennker **** > > Y Y A Solberg **** > > Y Y B Hardt **** > > Y Y B Medeiros **** > > Y Y C Matake **** > > Y Y C Mishra **** > > > _______________________________________________ > jose mailing list > jose@ietf.org <javascript:_e({}, 'cvml', 'jose@ietf.org');> > https://www.ietf.org/mailman/listinfo/jose**** > > ** ** >
- [jose] Header criticality -- hidden consensus? Richard Barnes
- Re: [jose] Header criticality -- hidden consensus? Mike Jones
- Re: [jose] Header criticality -- hidden consensus? Richard Barnes
- Re: [jose] Header criticality -- hidden consensus? Mike Jones
- Re: [jose] Header criticality -- hidden consensus? Brian Campbell
- Re: [jose] Header criticality -- hidden consensus? Richard Barnes
- Re: [jose] Header criticality -- hidden consensus? Brian Campbell
- Re: [jose] Header criticality -- hidden consensus? Richard Barnes
- Re: [jose] Header criticality -- hidden consensus? Mike Jones
- Re: [jose] Header criticality -- hidden consensus? Mike Jones
- Re: [jose] Header criticality -- hidden consensus? Richard Barnes
- Re: [jose] Header criticality -- hidden consensus? Richard Barnes
- Re: [jose] Header criticality -- hidden consensus? Mike Jones
- Re: [jose] Header criticality -- hidden consensus? Vladimir Dzhuvinov / NimbusDS
- Re: [jose] Header criticality -- hidden consensus? Hannes Tschofenig
- Re: [jose] Header criticality -- hidden consensus? Manger, James H
- Re: [jose] Header criticality -- hidden consensus? Vladimir Dzhuvinov / NimbusDS