Re: [jose] How would x5u really be used with JWE?

Brian Campbell <bcampbell@pingidentity.com> Fri, 25 January 2013 20:38 UTC

Return-Path: <bcampbell@pingidentity.com>
X-Original-To: jose@ietfa.amsl.com
Delivered-To: jose@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 184FB21F88B5 for <jose@ietfa.amsl.com>; Fri, 25 Jan 2013 12:38:15 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -5.976
X-Spam-Level:
X-Spam-Status: No, score=-5.976 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-4]
Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id e4u5Wam30NNg for <jose@ietfa.amsl.com>; Fri, 25 Jan 2013 12:38:14 -0800 (PST)
Received: from na3sys009aog115.obsmtp.com (na3sys009aog115.obsmtp.com [74.125.149.238]) by ietfa.amsl.com (Postfix) with ESMTP id 4D7B021F88B4 for <jose@ietf.org>; Fri, 25 Jan 2013 12:38:12 -0800 (PST)
Received: from mail-ia0-f200.google.com ([209.85.210.200]) (using TLSv1) by na3sys009aob115.postini.com ([74.125.148.12]) with SMTP ID DSNKUQLtM1Mnzy3Jk83QM8MZi/H/1+Mj3cu6@postini.com; Fri, 25 Jan 2013 12:38:12 PST
Received: by mail-ia0-f200.google.com with SMTP id i38so2091990iae.11 for <jose@ietf.org>; Fri, 25 Jan 2013 12:38:11 -0800 (PST)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=x-received:x-received:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc:content-type:x-gm-message-state; bh=n8u0yWeWbYxFwhX4/dKz0VB58P7AbXCnsvKWxBZF5Cw=; b=R+XXin2wofkGYbPmM5fSwwQfualswMtWLHtYoclhtmMRU0DfiodM47rNPuCnm26gdt 5NcdXI4vafaoxVug9SInApVjDCcZu76Ts8u2ofAaMeAC9Tk1op05fKA+gw02i8GztEHg ZbfzntaiXyerkmw0gBLHXiyxDILpvSCLpRcH0rDBka1ROpVdIvF8OqfHIE6jp66yDUVX INkWjxlveHG0nODcOHd1wTp8UHWtQa3W01huwTwjZg5pTmW7LjVkz8dNMMcJjDAD8L/C q9IIB35VrUdHBCAPtV6Q3riEgj4e/J8aXKF5P9WfKYDvUNvFAfkKneFeC62GKwM56te2 xivQ==
X-Received: by 10.50.214.39 with SMTP id nx7mr4804590igc.101.1359146291170; Fri, 25 Jan 2013 12:38:11 -0800 (PST)
X-Received: by 10.50.214.39 with SMTP id nx7mr4804576igc.101.1359146290922; Fri, 25 Jan 2013 12:38:10 -0800 (PST)
MIME-Version: 1.0
Received: by 10.64.17.134 with HTTP; Fri, 25 Jan 2013 12:37:40 -0800 (PST)
In-Reply-To: <D994E08C-6C84-471C-B0D4-225E0199011A@bbn.com>
References: <CA+k3eCRyew6xdKGQVOf27MK9AqOJ1A2jmhVYF+u=3Q3TMBtEng@mail.gmail.com> <42D3BCD6-D450-4A77-ABF5-87A5ABA874DE@bbn.com> <4E1F6AAD24975D4BA5B168042967394366A89CD9@TK5EX14MBXC285.redmond.corp.microsoft.com> <D994E08C-6C84-471C-B0D4-225E0199011A@bbn.com>
From: Brian Campbell <bcampbell@pingidentity.com>
Date: Fri, 25 Jan 2013 13:37:40 -0700
Message-ID: <CA+k3eCQ=Wt=9V5UmPAeDbfJRLBti1bEiS3z10jg1h_TpqS1PiQ@mail.gmail.com>
To: Richard Barnes <rbarnes@bbn.com>
Content-Type: multipart/alternative; boundary=14dae93406e3de45d104d422e764
X-Gm-Message-State: ALoCoQk3KsCFDujPeednqlFoOvyE8k4PYXw9MKQnccHUgStQyM7mh3DqPqUCexTihqaclKXrNjtRWv4HjX7G2RbTr0mZZk+AVzc62n3u6UjwaKkFl7UmFN6yWIMBS2DPyIoaJsLUmXom
Cc: Mike Jones <Michael.Jones@microsoft.com>, "jose@ietf.org" <jose@ietf.org>
Subject: Re: [jose] How would x5u really be used with JWE?
X-BeenThere: jose@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: Javascript Object Signing and Encryption <jose.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/jose>, <mailto:jose-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/jose>
List-Post: <mailto:jose@ietf.org>
List-Help: <mailto:jose-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/jose>, <mailto:jose-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Jan 2013 20:38:15 -0000

Yes of course signaling to the recipient which private key to use for
decryption is useful. Though it is unclear to me why one would use x5u or
x5c in the context of encryption rather than x5t or jku and/or kid. It
seems the later ones provide the same functionality in simpler and or more
concise ways.

The intent of my original post to the list wasn't to question the inclusion
of x5u or x5c in JWE (although I do think it's a fair question) but rather
to try and better understand what folks had envisioned doing with x5u and
encryption.  As Richard said, the key identification and roll-over are
typically application-layer questions. And I'm trying to work though those
very questions for OpenID Connect[1] right now. JWE dose provide some lower
level constructs to facilitate it at the app layer though (like jku, jwk,
x5u, x5t, x5c and kid) and, frankly, I didn't fully understand how some of
them were intended to be used so wanted to ask this group where they had
originated.

I haven't yet but will take a look at xmpp-e2e and see if there are any
concepts that can be borrowed.

Thanks,
Brian

[1] Two issues submitted against Connect on the general topic and the WG
home page
http://hg.openid.net/connect/issue/703/key-publication-needs-to-be-reworked
http://hg.openid.net/connect/issue/704/provide-key-rollover-guidance
http://openid.net/wg/connect/




On Fri, Jan 25, 2013 at 11:02 AM, Richard Barnes <rbarnes@bbn.com> wrote:

> Ok, that sort of makes sense.
>
> Note that in that case, there's no point to sending a cert chain ('x5c'),
> since it's the recipient's cert you're talking about.  Even 'x5u' is kind
> of overkill; all you really need is 'x5t'.
>
>
>
>
> On Jan 25, 2013, at 12:43 PM, Mike Jones <Michael.Jones@microsoft.com>
> wrote:
>
> > They're there exactly to let the recipient known which private key to
> use for decryption.  Hardly useless...
> >
> >                               -- Mike
> >
> > -----Original Message-----
> > From: jose-bounces@ietf.org [mailto:jose-bounces@ietf.org] On Behalf Of
> Richard Barnes
> > Sent: Friday, January 25, 2013 8:36 AM
> > To: Brian Campbell
> > Cc: jose@ietf.org
> > Subject: Re: [jose] How would x5u really be used with JWE?
> >
> > AFAICT, the X.509 fields in JWE are pretty useless.
> >
> > If you're using key transport (i.e., wrapping the symmetric key in a
> public key), then you would use the "jwk" or "jku" fields to reference the
> key pair you used to do the wrapping.  The only function of the public key
> crypto fields in a JWE is to let the recipient know which private key to
> use for decryption.  The recipient already needs to have the private key,
> since it obviously won't be in the message.
> >
> > The question of how the encrypting party figures out which public key to
> use for a given recipient (and in particular, roll-over), is an
> application-layer question, not something that JWE would address.  See the
> XMPP end-to-end security doc for an example; they use a separate exchange
> to associate a JWK with an XMPP ID.
> > <http://tools.ietf.org/html/draft-miller-xmpp-e2e>
> >
> > --Richard
> >
> >
> >
> >
> > On Jan 22, 2013, at 1:10 PM, Brian Campbell <bcampbell@pingidentity.com>
> wrote:
> >
> >> Is there a concrete use case for this that someone could explain to me?
> >>
> >> How does an encrypting party know what URL to use to get the key to
> encrypt? I assume some out-of-band exchange. How would key rolling work
> then? An an encrypting party would need to a priori know all potential
> x5u's of the decrypting party? Which seems dubious. And how would the
> decrypting party signal a desired change of keys?
> >>
> >> Am I missing something obvious here?
> >>
> >>
> >>
> >>
> >>
> >>
> >> _______________________________________________
> >> jose mailing list
> >> jose@ietf.org
> >> https://www.ietf.org/mailman/listinfo/jose
> >
> > _______________________________________________
> > jose mailing list
> > jose@ietf.org
> > https://www.ietf.org/mailman/listinfo/jose
> > _______________________________________________
> > jose mailing list
> > jose@ietf.org
> > https://www.ietf.org/mailman/listinfo/jose
>
>