Re: [jose] Header criticality -- hidden consensus?

Richard Barnes <rlb@ipv.sx> Sat, 09 February 2013 00:08 UTC

Return-Path: <rlb@ipv.sx>
X-Original-To: jose@ietfa.amsl.com
Delivered-To: jose@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1186521F8C2B for <jose@ietfa.amsl.com>; Fri, 8 Feb 2013 16:08:43 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: 0.48
X-Spam-Level:
X-Spam-Status: No, score=0.48 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FH_RELAY_NODNS=1.451, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, RCVD_IN_PBL=0.905, RDNS_NONE=0.1]
Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8151cEP-ZILf for <jose@ietfa.amsl.com>; Fri, 8 Feb 2013 16:08:42 -0800 (PST)
Received: from mail-la0-x229.google.com (la-in-x0229.1e100.net [IPv6:2a00:1450:4010:c03::229]) by ietfa.amsl.com (Postfix) with ESMTP id 875C521F8BE2 for <jose@ietf.org>; Fri, 8 Feb 2013 16:08:41 -0800 (PST)
Received: by mail-la0-f41.google.com with SMTP id fo12so4355687lab.0 for <jose@ietf.org>; Fri, 08 Feb 2013 16:08:40 -0800 (PST)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:x-received:x-originating-ip:in-reply-to:references :date:message-id:subject:from:to:cc:content-type:x-gm-message-state; bh=zhXvV9igfhMrlW0ap3hA2KJZCZw6mM1Fw4TseSx+ykY=; b=QGKLbLESYTYcQ8DYv9md555U/+JvEnSG/Am+TBd/kLXVLADTsc8NAawDK7497yn54w dVXSkrmRTfdfVncpYJY3Fn1uqlH/I0kYgR5KMDO2tFrffM3MJCHzwEGkPBS7Vu+VMvPs 0Q2aaHqOU1J8SC/jX++AL9hHV6N2oJPEwDTmCG/t1QX0WL71Oia9tBM6WZLwQq7uYqjh LdBuRDx4coFSFWTI/8jjNaBENosrNzfGV5ThwZqwGimzDWaoPNwRE1eHtn+V77v3ha5D a8lTS4i9RSCMY0GlPtl2FJkpHDArs0sT3DnG4h+PfloBpm0EqkRM9xyEMfhj30G4gOAu o8wQ==
MIME-Version: 1.0
X-Received: by 10.112.42.5 with SMTP id j5mr2898910lbl.37.1360368520109; Fri, 08 Feb 2013 16:08:40 -0800 (PST)
Received: by 10.112.147.164 with HTTP; Fri, 8 Feb 2013 16:08:39 -0800 (PST)
X-Originating-IP: [174.252.108.244]
In-Reply-To: <4E1F6AAD24975D4BA5B168042967394367421FAC@TK5EX14MBXC284.redmond.corp.microsoft.com>
References: <4E1F6AAD24975D4BA5B168042967394367421FAC@TK5EX14MBXC284.redmond.corp.microsoft.com>
Date: Fri, 08 Feb 2013 19:08:39 -0500
Message-ID: <CAL02cgTTBueQ-_q1Soam5Z2cy_+pUHpcw6RjS+e7dZ=hmbsxzw@mail.gmail.com>
From: Richard Barnes <rlb@ipv.sx>
To: Mike Jones <Michael.Jones@microsoft.com>
Content-Type: multipart/alternative; boundary="e0cb4efe3572679f2304d53f7a2c"
X-Gm-Message-State: ALoCoQlb91HMn3KxXCYAhwpGsX84VgxRuMFSONSN4ArripVcEs1eqMo8XTHWYNe1OOEqJ3roUnfA
Cc: Brian Campbell <bcampbell@pingidentity.com>, "jose@ietf.org" <jose@ietf.org>
Subject: Re: [jose] Header criticality -- hidden consensus?
X-BeenThere: jose@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: Javascript Object Signing and Encryption <jose.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/jose>, <mailto:jose-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/jose>
List-Post: <mailto:jose@ietf.org>
List-Help: <mailto:jose-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/jose>, <mailto:jose-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 09 Feb 2013 00:08:43 -0000

Thanks for the revisions, but the absolute numbers really don't matter.
 The important feature is that nobody voted Yes on 1 and No on 2.



On Friday, February 8, 2013, Mike Jones wrote:

>  FWIW, I believe that John Bradley’s, Ryo Ito’s, and Dick Hardt’s
> responses are also incorrectly tallied below, the caveats on Breno de
> Medeiros’ “B” are missing, and Chuck Mortimore’s response is missing.  I
> believe that their responses were:****
>
> ** **
>
> N       Y       A    Campbell         ****
>
> N       Y       A    Bradley         ****
>
> N       Y       A    Ito             ****
>
> Y       Y       C    Hardt           (Dick changed his answer on 3)****
>
> Y       Y       B*    de Medeiros         (*B if the new header can be
> omitted, so that 3-component JWTs are still valid. I don't support this
> option if backwards-incompatible.)****
>
> Y       Y       A    Mortimore             ****
>
> ** **
>
> By my count, this would bring the answers to date on the first question to:
> ****
>
> ** **
>
> 16 “yes”****
>
> 10 “no”****
>
> ** **
>
> FWIW****
>
> ** **
>
> And yes, the IETF doesn’t vote… J  I’m sure we’ll have an interesting
> discussion after the polling period is over on Monday.  As for me, I have
> been actively thinking about how to meet everyone’s perceived needs, but
> will hold off on that until after Monday.****
>
> ** **
>
>                                                                 Take care,
> ****
>
>                                                                 -- Mike***
> *
>
> ** **
>
> *From:* jose-bounces@ietf.org <javascript:_e({}, 'cvml',
> 'jose-bounces@ietf.org');> [mailto:jose-bounces@ietf.org<javascript:_e({}, 'cvml', 'jose-bounces@ietf.org');>]
> *On Behalf Of *Brian Campbell
> *Sent:* Friday, February 08, 2013 3:35 PM
> *To:* Richard Barnes
> *Cc:* jose@ietf.org <javascript:_e({}, 'cvml', 'jose@ietf.org');>
> *Subject:* Re: [jose] Header criticality -- hidden consensus?****
>
> ** **
>
> FWIW, I didn't see my name on the tabulation but I did 'vote'
> http://www.ietf.org/mail-archive/web/jose/current/msg01461.html****
>
> ** **
>
> On Fri, Feb 8, 2013 at 4:11 PM, Richard Barnes <rlb@ipv.sx<javascript:_e({}, 'cvml', 'rlb@ipv.sx');>>
> wrote:****
>
> We're 24 votes into the header criticality poll, so I thought I would go
> ahead and take a look at how the results are shaping up.  My initial
> tabulation is below.  The result on the FIRST POLL (the main one) is as
> follows:****
>
> ** **
>
> No: 10****
>
> Yes: 14****
>
> ** **
>
> What I find striking, however, is that every single person that voted
> "Yes" on the FIRST POLL also voted "Yes" on the SECOND POLL.  So nobody who
> thinks that all headers should be critical thinks that a JOSE library
> should actually be required to enforce this constraint.  And that means
> that enforcing that all headers are supported cannot be a MUST according to
> RFC 2119.****
>
> ** **
>
> So I wonder if there's consensus to remove the following text from JWE and
> JWS:****
>
> -----BEGIN-JWE-----****
>
>    4.   The resulting JWE Header MUST be validated to only include****
>
>         parameters and values whose syntax and semantics are both****
>
>         understood and supported.****
>
> -----END-JWE-----****
>
> -----BEGIN-JWS-----****
>
>    4.  The resulting JWS Header MUST be validated to only include****
>
>        parameters and values whose syntax and semantics are both****
>
>        understood and supported.****
>
> -----END-JWS-----****
>
> ** **
>
> Otherewise, a JOSE library conforming to these specifications would be
> REQUIRED (a synonym to MUST in 2119) to reject a JWE/JWS that contains an
> unknown header, contradicting all those "Yes" votes on the SECOND POLL.***
> *
>
> ** **
>
> --Richard****
>
> ** **
>
> ** **
>
> ** **
>
> -----BEGIN-Tabulation-----****
>
> 1       2       3    Name:           ****
>
> N       -       -    Bradley         ****
>
> N       -       -    Ito             ****
>
> N       N       A    Yee             ****
>
> N       N       B    Barnes          ****
>
> N       N       B    Rescorla        ****
>
> N       N       C    Manger          ****
>
> N       N       C    Octman          ****
>
> N       Y       A    Fletcher        ****
>
> N       Y       A    Miller          ****
>
> N       Y       A    Sakimura        ****
>
> Y       Y       -    D'Agostino      ****
>
> Y       Y       A    Biering         ****
>
> Y       Y       A    Brault          ****
>
> Y       Y       A    Hedberg         ****
>
> Y       Y       A    Jay             ****
>
> Y       Y       A    Jones           ****
>
> Y       Y       A    Marais          ****
>
> Y       Y       A    Nadalin         ****
>
> Y       Y       A    Nara            ****
>
> Y       Y       A    Nennker         ****
>
> Y       Y       A    Solberg         ****
>
> Y       Y       B    Hardt           ****
>
> Y       Y       B    Medeiros        ****
>
> Y       Y       C    Matake          ****
>
> Y       Y       C    Mishra    ****
>
>
> _______________________________________________
> jose mailing list
> jose@ietf.org <javascript:_e({}, 'cvml', 'jose@ietf.org');>
> https://www.ietf.org/mailman/listinfo/jose****
>
> ** **
>