[jose] Stephen Farrell's Abstain on draft-ietf-jose-jwk-thumbprint-07: (with COMMENT)

["Stephen Farrell" <[e-mail]>]

Stephen Farrell has entered the following ballot position for
draft-ietf-jose-jwk-thumbprint-07: Abstain

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)


Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.


The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-jose-jwk-thumbprint/



----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

This draft chooses the wrong input to the hash function. Other
specifications, even those that do not otherwise use ASN.1 use 
the SubjectPublicKeyInfo ASN.1 structure for that. I raised
that point in the WG and during IETF LC but was in the rough.
Nonetheless, this will I believe need to be done over later
when or if there is a need to identify a public key in a 
cross-protocol or similar context. That's a waste of effort
for no good reason. The world won't end though.