Re: [jose] #15: Broken examples in JWE / JWS

 /* special magic */ is just some out of band agreement on the key to use
or how to infer it. Which isn't really special or magic. But probably
pretty common.

On Fri, Mar 22, 2013 at 7:37 PM, Richard Barnes <rlb@ipv.sx> wrote:

> I've renamed the issue to try to clarify.
>
> You're right that there are alternative ways to locate a key.  But a JOSE
> object needs to contain at least one of them, or else the /* special magic
> */ clause applies.
>
> --Richard
>
>
> On Fri, Mar 22, 2013 at 9:15 PM, Jim Schaad <ietf@augustcellars.com>wrote:
>
>> This may or may not be a flaw in the specification.  However the item you
>> created in the tracker does not reflect what you have put here.  I think
>> you would be better served by saying that there is a flaw in the
>> specifications in that there should be a MUST that some type of key or key
>> reference is required in a JWS or JWE.****
>>
>> ** **
>>
>> I would note that your example code should be more complex in that it
>> does not deal with jku or any of the x* methods of referencing keys.****
>>
>> ** **
>>
>> Jim****
>>
>> ** **
>>
>> ** **
>>
>> *From:* Richard Barnes [mailto:rlb@ipv.sx]
>> *Sent:* Friday, March 22, 2013 4:09 PM
>> *To:* Jim Schaad
>> *Cc:* draft-ietf-jose-json-web-encryption@tools.ietf.org; jose@ietf.org
>>
>> *Subject:* Re: [jose] #15: Broken examples in JWE / JWS****
>>
>> ** **
>>
>> I admit that they are not broken according to the current spec.  However,
>> I have a lot of trouble figuring out how I would write code to process them.
>> ****
>>
>> ** **
>>
>> If "kid" or "jwk" MUST be present to indicate what key I should use, then
>> I can have deterministic code:****
>>
>> if (/* recognized "kid" or "jwk" value */) { ****
>>
>>     /* use it */****
>>
>> } else {****
>>
>>     /* FAIL.  can't process this object */****
>>
>> }****
>>
>> ** **
>>
>> As the spec stands, I have no idea what to put in that "else" clause.
>>  I'm clearly not supposed to fail, because the parameters are optional.
>>  But what else?****
>>
>> if (/* recognized "kid" or "jwk" value */) { ****
>>
>>     /* use it */****
>>
>> } else {****
>>
>>     /* insert special magic here */****
>>
>> }****
>>
>> ** **
>>
>> This is actually what SPI is supposed to clear up.  SPI would provide an
>> explicit third branch for the special magic to live in.****
>>
>> if (/* recognized "kid" or "jwk" value */) { ****
>>
>>     /* use it */****
>>
>> } else if (/* recognized SPI value */) {****
>>
>>     /* process using stored parameters */****
>>
>> } else {****
>>
>>     /* FAIL.  can't process this object */****
>>
>> }****
>>
>> ** **
>>
>> But without the concept of SPI, the spec is broken because of the
>> non-determinism noted above.****
>>
>> ** **
>>
>> --Richard****
>>
>> ** **
>>
>> ** **
>>
>> ** **
>>
>> On Fri, Mar 22, 2013 at 6:13 PM, Jim Schaad <ietf@augustcellars.com>
>> wrote:****
>>
>> My inclination is that this response is correct.
>>
>> What make you think that the key or key reference is required and cannot
>> be
>> implied?
>>
>> Jim****
>>
>>
>>
>> > -----Original Message-----
>> > From: jose-bounces@ietf.org [mailto:jose-bounces@ietf.org] On Behalf Of
>> > jose issue tracker
>> > Sent: Friday, March 22, 2013 2:37 PM
>> > To: draft-ietf-jose-json-web-encryption@tools.ietf.org;
>> ignisvulpis@gmail.com
>> > Cc: jose@ietf.org
>> > Subject: Re: [jose] #15: Broken examples in JWE / JWS
>> >
>> > #15: Broken examples in JWE / JWS
>> >
>> >
>> > Comment (by ignisvulpis@gmail.com):
>> >
>> >  I think this is not an issue. The examples are NOT broken and they do
>> not
>> > need a fix.
>> >  I suggest to close this ticket.
>> >  The draft should definitely not make these illegal. These objects are
>> perfect
>> > examples for a valid JWS/JWE.
>> >
>> > --
>> > -------------------------+----------------------------------------------
>> ****
>>
>> > -------------------------+---****
>>
>> >  Reporter:  rlb@ipv.sx   |       Owner:  draft-ietf-jose-json-web-
>> >      Type:  defect       |  encryption@tools.ietf.org
>> >  Priority:  minor        |      Status:  new
>> > Component:  json-web-    |   Milestone:
>> >   encryption             |     Version:
>> >  Severity:  -            |  Resolution:
>> >  Keywords:               |
>> > -------------------------+----------------------------------------------
>> ****
>>
>> > -------------------------+---****
>>
>> >
>> > Ticket URL: <
>> http://trac.tools.ietf.org/wg/jose/trac/ticket/15#comment:1>
>> > jose <http://tools.ietf.org/jose/>
>> >
>> > _______________________________________________
>> > jose mailing list
>> > jose@ietf.org
>> > https://www.ietf.org/mailman/listinfo/jose****
>>
>> ** **
>>
>
>
> _______________________________________________
> jose mailing list
> jose@ietf.org
> https://www.ietf.org/mailman/listinfo/jose
>
>