Re: [jose] Question on enc location
Mike Jones <Michael.Jones@microsoft.com> Tue, 30 July 2013 09:14 UTC
Return-Path: <Michael.Jones@microsoft.com>
X-Original-To: jose@ietfa.amsl.com
Delivered-To: jose@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C3B7521F9E51 for <jose@ietfa.amsl.com>; Tue, 30 Jul 2013 02:14:47 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.093
X-Spam-Level:
X-Spam-Status: No, score=-3.093 tagged_above=-999 required=5 tests=[AWL=-0.495, BAYES_00=-2.599, HTML_MESSAGE=0.001]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id O2zb7Ydw3Wgy for <jose@ietfa.amsl.com>; Tue, 30 Jul 2013 02:14:41 -0700 (PDT)
Received: from db8outboundpool.messaging.microsoft.com (mail-db8lp0184.outbound.messaging.microsoft.com [213.199.154.184]) by ietfa.amsl.com (Postfix) with ESMTP id 41C5421E8104 for <jose@ietf.org>; Tue, 30 Jul 2013 02:08:30 -0700 (PDT)
Received: from mail131-db8-R.bigfish.com (10.174.8.241) by DB8EHSOBE033.bigfish.com (10.174.4.96) with Microsoft SMTP Server id 14.1.225.22; Tue, 30 Jul 2013 09:08:27 +0000
Received: from mail131-db8 (localhost [127.0.0.1]) by mail131-db8-R.bigfish.com (Postfix) with ESMTP id BA1534E0056; Tue, 30 Jul 2013 09:08:27 +0000 (UTC)
X-Forefront-Antispam-Report: CIP:131.107.125.8; KIP:(null); UIP:(null); IPV:NLI; H:TK5EX14HUBC105.redmond.corp.microsoft.com; RD:autodiscover.service.exchange.microsoft.com; EFVD:NLI
X-SpamScore: -21
X-BigFish: VS-21(zz98dI9371Ic85fhzz1f42h208ch1ee6h1de0h1fdah2073h1202h1e76h1d1ah1d2ah1fc6hzz1d7338h1de098h1033IL17326ah18c673h1de096h8275bh182cceh8275dh1de097hdda1eiz2fh2a8h668h839hd25hf0ah1288h12a5h12bdh137ah1441h1504h1537h153bh15d0h162dh1631h1758h18e1h1946h19b5h19ceh1b0ah1bceh1d0ch1d2eh1d3fh1dc1h1dfeh1dffh1e1dh1155h)
Received-SPF: pass (mail131-db8: domain of microsoft.com designates 131.107.125.8 as permitted sender) client-ip=131.107.125.8; envelope-from=Michael.Jones@microsoft.com; helo=TK5EX14HUBC105.redmond.corp.microsoft.com ; icrosoft.com ;
Received: from mail131-db8 (localhost.localdomain [127.0.0.1]) by mail131-db8 (MessageSwitch) id 1375175305236357_12547; Tue, 30 Jul 2013 09:08:25 +0000 (UTC)
Received: from DB8EHSMHS008.bigfish.com (unknown [10.174.8.247]) by mail131-db8.bigfish.com (Postfix) with ESMTP id 2A1C138004A; Tue, 30 Jul 2013 09:08:25 +0000 (UTC)
Received: from TK5EX14HUBC105.redmond.corp.microsoft.com (131.107.125.8) by DB8EHSMHS008.bigfish.com (10.174.4.18) with Microsoft SMTP Server (TLS) id 14.16.227.3; Tue, 30 Jul 2013 09:08:23 +0000
Received: from TK5EX14MBXC284.redmond.corp.microsoft.com ([169.254.1.38]) by TK5EX14HUBC105.redmond.corp.microsoft.com ([157.54.80.48]) with mapi id 14.03.0136.001; Tue, 30 Jul 2013 09:08:22 +0000
From: Mike Jones <Michael.Jones@microsoft.com>
To: Jim Schaad <ietf@augustcellars.com>, 'Richard Barnes' <rlb@ipv.sx>
Thread-Topic: [jose] Question on enc location
Thread-Index: Ac6NBFUqw0aJXcW7SEaBvNAAMPq+3Q==
Date: Tue, 30 Jul 2013 09:08:21 +0000
Message-ID: <4E1F6AAD24975D4BA5B16804296739436B730985@TK5EX14MBXC284.redmond.corp.microsoft.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-originating-ip: [157.54.51.34]
Content-Type: multipart/alternative; boundary="_000_4E1F6AAD24975D4BA5B16804296739436B730985TK5EX14MBXC284r_"
MIME-Version: 1.0
X-OriginatorOrg: microsoft.com
X-FOPE-CONNECTOR: Id%0$Dn%*$RO%0$TLS%0$FQDN%$TlsDn%
Cc: "jose@ietf.org" <jose@ietf.org>
Subject: Re: [jose] Question on enc location
X-BeenThere: jose@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: Javascript Object Signing and Encryption <jose.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/jose>, <mailto:jose-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/jose>
List-Post: <mailto:jose@ietf.org>
List-Help: <mailto:jose-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/jose>, <mailto:jose-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 30 Jul 2013 09:14:47 -0000
These points are now clarified in the -14 drafts. -- Mike From: Mike Jones Sent: Tuesday, July 23, 2013 2:33 PM To: 'Jim Schaad'; 'Richard Barnes' Cc: jose@ietf.org<mailto:jose@ietf.org> Subject: RE: [jose] Question on enc location For the second, you're right - you don't need encrypted_key. I'll plan to be clear on that (and the other fields that are omitted for some algorithms) for the JSON Serializations. I believe you still need "recipients" - for consistency reasons, even if the array elements contain an empty object. -- Mike From: Jim Schaad [mailto:ietf@augustcellars.com] Sent: Tuesday, July 23, 2013 1:48 PM To: Mike Jones; 'Richard Barnes' Cc: jose@ietf.org<mailto:jose@ietf.org> Subject: RE: [jose] Question on enc location But in this case I don't think that I need an encrypted key value because I am using direct. From: Mike Jones [mailto:Michael.Jones@microsoft.com] Sent: Tuesday, July 23, 2013 8:29 AM To: Jim Schaad; 'Richard Barnes' Cc: jose@ietf.org<mailto:jose@ietf.org> Subject: RE: [jose] Question on enc location For the first, no - it's missing the required "recipients" element. For the second, no - the "recipients" value is missing the required "encrypted_key" value. Answering Richard's comment - I expect that in most cases people will put elements such as "enc" that are common between all recipients in either the "protected" or "unprotected" top-level headers, but this isn't a requirement. In the worst case, should a sender use different "enc" values for different recipients, the result will be that the JWE will fail to decrypt for all the recipients in which the "enc" value is incorrect. -- Mike From: Jim Schaad [mailto:ietf@augustcellars.com] Sent: Tuesday, July 23, 2013 5:23 AM To: 'Richard Barnes'; Mike Jones Cc: jose@ietf.org<mailto:jose@ietf.org> Subject: RE: [jose] Question on enc location As a follow up. Is this legal? { Header: <alg:"direct", enc:"AES-GCM"}, IV: ..., tag:..., payload:... } Or is the line Recipients:[{}], Required? From: Richard Barnes [mailto:rlb@ipv.sx] Sent: Tuesday, July 23, 2013 5:04 AM To: Mike Jones Cc: Jim Schaad; jose@ietf.org<mailto:jose@ietf.org> Subject: Re: [jose] Question on enc location In which case, it seems like it should be in the top level header, to avoid having it repeated every time. In general, it seems like there are "content" parameters (e.g., enc, zip, cty) that should go at the top level, and "key" parameters that should be per-recipient (e.g., alg, epk, salt). It would be helpful to implementors to be clear about what goes where. On Monday, July 22, 2013, Mike Jones wrote: No - just that the "enc" field for all recipients be the same. From: jose-bounces@ietf.org<javascript:_e(%7b%7d,%20'cvml',%20'jose-bounces@ietf.org');> [mailto:jose-bounces@ietf.org<javascript:_e(%7b%7d,%20'cvml',%20'jose-bounces@ietf.org');>] On Behalf Of Jim Schaad Sent: Monday, July 22, 2013 4:33 PM To: jose@ietf.org<javascript:_e(%7b%7d,%20'cvml',%20'jose@ietf.org');> Subject: [jose] Question on enc location Is there supposed to be a requirement in the JWE specification that the enc field be in the common protected (or unprotected) header and no in the individual recipient header information? Jim
- Re: [jose] Question on enc location Mike Jones
- [jose] Question on enc location Jim Schaad
- Re: [jose] Question on enc location Mike Jones
- Re: [jose] Question on enc location Richard Barnes
- Re: [jose] Question on enc location Jim Schaad
- Re: [jose] Question on enc location Richard Barnes
- Re: [jose] Question on enc location Mike Jones
- Re: [jose] Question on enc location Jim Schaad
- Re: [jose] Question on enc location Mike Jones