IETF Logo Mail Archive

Re: [jose] DISCUSS: Nonce/Timestamp parameter

Brian Eaton <beaton@google.com> Mon, 27 August 2012 20:06 UTC

Return-Path: <beaton@google.com>
X-Original-To: jose@ietfa.amsl.com
Delivered-To: jose@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1E7FD21F8539 for <jose@ietfa.amsl.com>; Mon, 27 Aug 2012 13:06:23 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -102.976
X-Spam-Level:
X-Spam-Status: No, score=-102.976 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-1, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9IxIueu2Yzq2 for <jose@ietfa.amsl.com>; Mon, 27 Aug 2012 13:06:22 -0700 (PDT)
Received: from mail-lpp01m010-f44.google.com (mail-lpp01m010-f44.google.com [209.85.215.44]) by ietfa.amsl.com (Postfix) with ESMTP id 5D0C021F852E for <jose@ietf.org>; Mon, 27 Aug 2012 13:06:21 -0700 (PDT)
Received: by lahm15 with SMTP id m15so2963023lah.31 for <jose@ietf.org>; Mon, 27 Aug 2012 13:06:20 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type:x-system-of-record; bh=giIh/NlfPcJXxkhCwVDkI8qNeisJjFHUVdvoT2KvSBQ=; b=ZCKhdG3RNDkkTtPGRiMGNh6F9SYR0oWfCYw4B2v8sfv481VSwvY7xa2MXo/b3cPtFq aKgdRnbktGNdVMHZN8E8Or9oB6phE1JKiwM3PfvjsLOJGdlLXSHikPChwT0CJPHdmWre CksY2kOrOVcvLJgzYP8KmDChiPRU0R+2AZJHOTTdVujSikn0QBhcLhVbiVrV5NcRTJ8S 3imtnk4QlFnJgOf8rYVdIPKOaCT9ECckSgz2js+EZ4sRwyKdGQl7pyUUIny3yphdk9tN PeqrEZ6iPT6iDYccWRK6tsgg4fKnkdp0h9O1+svU5FvzpXjTQiPVLvHeSrw6F8Pjrg0F CpjQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type:x-system-of-record:x-gm-message-state; bh=giIh/NlfPcJXxkhCwVDkI8qNeisJjFHUVdvoT2KvSBQ=; b=ZObHPVzND8Q02MNm2Z7ul/1rEl8at4Tsqcu/bnAULoHMJilgi3+bQPGh1vgpc+DgPT dAJat/XzWjKpGXFD9NHpMEZF0vu4hC7+uNuaM8o1tzgCTlAHEjseX3MZ/dgit/lCuvjr GMOA6uu39bc50WsVTtpXeCLACC/jdGb/dCXsrZNqfSV5kN93G4BZEMC71Jv1FgRKzJ1x TXY8ZxCXo7bttcaAWpsW8t9V9C7hE7vmlUZeTp+LzXiyurrLuaSJEBp6PvqutPODckMF D9UBtx1v+3F26+vlOOgKoWXBLviZwrMvHVLLO3tm+ASs6T9cJ8IN+fN1cOkIJDQI2/mD TuaA==
Received: by 10.152.144.168 with SMTP id sn8mr16108186lab.1.1346097980215; Mon, 27 Aug 2012 13:06:20 -0700 (PDT)
MIME-Version: 1.0
Received: by 10.152.144.168 with SMTP id sn8mr16108166lab.1.1346097980001; Mon, 27 Aug 2012 13:06:20 -0700 (PDT)
Received: by 10.112.60.41 with HTTP; Mon, 27 Aug 2012 13:06:19 -0700 (PDT)
In-Reply-To: <8777DAED-4ADA-4691-B5CD-0E5CF308BC1C@gmail.com>
References: <CE8995AB5D178F44A2154F5C9A97CAF402517E00B8B5@HE111541.emea1.cds.t-internal.com> <CE8995AB5D178F44A2154F5C9A97CAF402517E00C0E7@HE111541.emea1.cds.t-internal.com> <8777DAED-4ADA-4691-B5CD-0E5CF308BC1C@gmail.com>
Date: Mon, 27 Aug 2012 13:06:19 -0700
Message-ID: <CALT9B_Tnz+9=a-NPuUTeSb31fFMi1cJMB-SeM7QJmSh=XrhHTA@mail.gmail.com>
From: Brian Eaton <beaton@google.com>
To: Dick Hardt <dick.hardt@gmail.com>
Content-Type: multipart/alternative; boundary="e89a8f234687ee4e0a04c844db80"
X-System-Of-Record: true
X-Gm-Message-State: ALoCoQmrdduEzLltv3PwUOikXPHAgsrVccwdRnq+7ez/yKkPlra1/LVLxrax8+8ZjUu1sGC2L+81XKO3kXEzPFsf1pnE+DKF5a2u5WIpfAsgWG+McoqqItNSqNAvRz8alvZLc1TFEP1jcwW3KZ7w5ow851/dvk1SReDw8+tF0e2WDObpUi7r1OhxjVXeOKXjyaazblyxWUAY
Cc: ietf@augustcellars.com, jose@ietf.org, Axel.Nennker@telekom.de
Subject: Re: [jose] DISCUSS: Nonce/Timestamp parameter
X-BeenThere: jose@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: Javascript Object Signing and Encryption <jose.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/jose>, <mailto:jose-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/jose>
List-Post: <mailto:jose@ietf.org>
List-Help: <mailto:jose-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/jose>, <mailto:jose-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 27 Aug 2012 20:06:23 -0000

On Mon, Aug 27, 2012 at 12:11 PM, Dick Hardt <dick.hardt@gmail.com> wrote:

> I have an application for JWT that is not OAuth2.
>

Should nonce and timestamp logic go in the application level protocol?


> Having said that, nonce's are difficult to implement at scale and I have
> heard of many sites that don't implement them fully.
>

Nonce alone can't be implemented efficiently.  You have to have time stamps
as well, otherwise you are stuck storing ever nonce you've ever seen,
forever.

Even nonce + time stamp is challenging in distributed systems.  It adds a
lot of complexity.  That complexity is sometimes merited, but not always.

v2.43.4 | Report a Bug | By Email | System Status