IETF Logo Mail Archive

Re: [jose] DISCUSS: Nonce/Timestamp parameter

<Axel.Nennker@telekom.de> Tue, 28 August 2012 04:30 UTC

Return-Path: <Axel.Nennker@telekom.de>
X-Original-To: jose@ietfa.amsl.com
Delivered-To: jose@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 40F7221E803F for <jose@ietfa.amsl.com>; Mon, 27 Aug 2012 21:30:20 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.248
X-Spam-Level:
X-Spam-Status: No, score=-3.248 tagged_above=-999 required=5 tests=[AWL=-0.000, BAYES_00=-2.599, HELO_EQ_DE=0.35, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1RvXbtBPOUJG for <jose@ietfa.amsl.com>; Mon, 27 Aug 2012 21:30:19 -0700 (PDT)
Received: from tcmail73.telekom.de (tcmail73.telekom.de [217.243.239.135]) by ietfa.amsl.com (Postfix) with ESMTP id 282A021E8039 for <jose@ietf.org>; Mon, 27 Aug 2012 21:30:18 -0700 (PDT)
Received: from he113414.emea1.cds.t-internal.com ([10.125.65.80]) by tcmail71.telekom.de with ESMTP/TLS/AES128-SHA; 28 Aug 2012 06:30:17 +0200
Received: from HE111541.emea1.cds.t-internal.com ([169.254.2.25]) by HE113414.emea1.cds.t-internal.com ([2002:7cd:4150::7cd:4150]) with mapi; Tue, 28 Aug 2012 06:30:16 +0200
From: Axel.Nennker@telekom.de
To: kent@bbn.com, jose@ietf.org
Date: Tue, 28 Aug 2012 06:30:13 +0200
Thread-Topic: [jose] DISCUSS: Nonce/Timestamp parameter
Thread-Index: Ac2E1FkVDWRwHUA/RZSnc4vLTezgDQAAHgaA
Message-ID: <CE8995AB5D178F44A2154F5C9A97CAF402517E00C11A@HE111541.emea1.cds.t-internal.com>
References: <CE8995AB5D178F44A2154F5C9A97CAF402517E00B8B5@HE111541.emea1.cds.t-internal.com> <CE8995AB5D178F44A2154F5C9A97CAF402517E00C0E7@HE111541.emea1.cds.t-internal.com> <503C46D8.9020808@bbn.com>
In-Reply-To: <503C46D8.9020808@bbn.com>
Accept-Language: de-DE
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
acceptlanguage: de-DE
Content-Type: multipart/alternative; boundary="_000_CE8995AB5D178F44A2154F5C9A97CAF402517E00C11AHE111541eme_"
MIME-Version: 1.0
Subject: Re: [jose] DISCUSS: Nonce/Timestamp parameter
X-BeenThere: jose@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: Javascript Object Signing and Encryption <jose.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/jose>, <mailto:jose-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/jose>
List-Post: <mailto:jose@ietf.org>
List-Help: <mailto:jose-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/jose>, <mailto:jose-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 28 Aug 2012 04:30:20 -0000

I agree that jwt is  useful without oauth2.
Still we already have exp, iat, jti in jwt.
What protection do nonce/timestamp bring to jwt users?

I think the poll about this question should be reconsidered because the question is unclear and nonce/timestamp have no supporting use case beyond exp, iat, jti.

Axel


From: Stephen Kent [mailto:kent@bbn.com]
Sent: Tuesday, August 28, 2012 6:20 AM
To: jose@ietf.org; Nennker, Axel
Subject: Re: [jose] DISCUSS: Nonce/Timestamp parameter

Axel,

I did not vote on this issue, but I am concerned by what appears to be the basis for your
position. Specifically, you say:

Maybe there is some justification for nonce in jwt but if jwt is used with oauth2 then we already have state.

JOSE's cope is not just oauth2, so it seems inappropriate to argue that a feature is not
needed based on just that app.

Steve

v2.43.4 | Report a Bug | By Email | System Status