Re: [jose] Should we delete the "typ" header field
Richard Barnes <rlb@ipv.sx> Thu, 30 May 2013 03:03 UTC
Return-Path: <rlb@ipv.sx>
X-Original-To: jose@ietfa.amsl.com
Delivered-To: jose@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1E67021F929F for <jose@ietfa.amsl.com>; Wed, 29 May 2013 20:03:11 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -0.425
X-Spam-Level:
X-Spam-Status: No, score=-0.425 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FH_RELAY_NODNS=1.451, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, RDNS_NONE=0.1]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Pr+nCtC2SR6O for <jose@ietfa.amsl.com>; Wed, 29 May 2013 20:03:07 -0700 (PDT)
Received: from mail-ob0-x229.google.com (mail-ob0-x229.google.com [IPv6:2607:f8b0:4003:c01::229]) by ietfa.amsl.com (Postfix) with ESMTP id 5DF8521F9294 for <jose@ietf.org>; Wed, 29 May 2013 20:03:06 -0700 (PDT)
Received: by mail-ob0-f169.google.com with SMTP id up14so5366327obb.14 for <jose@ietf.org>; Wed, 29 May 2013 20:03:06 -0700 (PDT)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:x-originating-ip:in-reply-to:references:date :message-id:subject:from:to:cc:content-type:x-gm-message-state; bh=mdIyupjGHyqvq5/miuACf8D4WQRDtG2litRz5Mc2VbI=; b=h4W8qrlA1XPFh9ENvT98G1mOMqUJ75iUercpXIm2qfrhW8Sd15S6jlVpAsf+MRDEJ5 S4kotl3Bg6dPw7+lL7Qv5eZvaeaOyWjglFa85MO9X4Np/E9BejbknaJmNBVmC3Vkk/q7 RIUJyBMgf/5hbHClXZ8PEMa34WUZNF76Rh+OvyoA9/HV/MyhwJVIuJDi/SN2WbRont25 crmZ0apBaCMHljMYrNrefTBg6o8xbcuoGCZ4lY9zvTenFalB56rtkV4oLDsObGCoUI8x nrUNtWZuVBaGcd+57VV9eFztib9G7LDYgMCohfWhXbdoMbymuJgMJ5WzayOGu0yj1bC5 qnFQ==
MIME-Version: 1.0
X-Received: by 10.60.46.70 with SMTP id t6mr3266815oem.121.1369882985868; Wed, 29 May 2013 20:03:05 -0700 (PDT)
Received: by 10.60.17.9 with HTTP; Wed, 29 May 2013 20:03:05 -0700 (PDT)
X-Originating-IP: [128.89.255.98]
In-Reply-To: <4E1F6AAD24975D4BA5B1680429673943677C5C0A@TK5EX14MBXC285.redmond.corp.microsoft.com>
References: <02b701ce5cb8$46ae77e0$d40b67a0$@augustcellars.com> <CAD9ie-vK3gY9b9GQrbUa=TACy5KVA1uPH_u_utucoKzVynjuiA@mail.gmail.com> <02f501ce5cc5$ec9a2200$c5ce6600$@augustcellars.com> <CAD9ie-uV-THE0+oL-dNUB0qXF7sx8jHMZDCz8vGESmUHWV=LMg@mail.gmail.com> <4E1F6AAD24975D4BA5B1680429673943677C58C4@TK5EX14MBXC285.redmond.corp.microsoft.com> <CAD9ie-sm7q6gdzC-aTKt=+b=A8wB68ExTP1FwiT=zQTN7b69zA@mail.gmail.com> <4E1F6AAD24975D4BA5B1680429673943677C5C0A@TK5EX14MBXC285.redmond.corp.microsoft.com>
Date: Wed, 29 May 2013 23:03:05 -0400
Message-ID: <CAL02cgR=Lh5_HogPtgoFM+qhwNkqOFaW0+TzOCAziUwK8ZqQaw@mail.gmail.com>
From: Richard Barnes <rlb@ipv.sx>
To: Mike Jones <Michael.Jones@microsoft.com>
Content-Type: multipart/alternative; boundary="089e01494972c1c26904dde6bca7"
X-Gm-Message-State: ALoCoQlwlwtirrUcrdhiVwpAdKJ+ptf04L7UbEMzsAtZnXoyG/9sKIS7kyyQKwBwCOygRbAqNDvR
Cc: Jim Schaad <ietf@augustcellars.com>, "jose@ietf.org" <jose@ietf.org>, Dick Hardt <dick.hardt@gmail.com>
Subject: Re: [jose] Should we delete the "typ" header field
X-BeenThere: jose@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: Javascript Object Signing and Encryption <jose.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/jose>, <mailto:jose-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/jose>
List-Post: <mailto:jose@ietf.org>
List-Help: <mailto:jose-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/jose>, <mailto:jose-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 30 May 2013 03:03:11 -0000
If this is the level of "type" you're referring to, I think we should drop it from the spec. It's an application-layer thing that the app can add or not according to its wishes. I'm with Dick on this. I think we should either have a mandatory indicator of what type of JOSE object this, or nothing at all. If the former, the allowable values are "JWE" and "JWS". The "+JSON" options are non-sensical -- the app needs to know what it's parsing before it gets this header. While I have a preference for the former (for clarity), the latter approach is also OK with me, since the MIME types are specific to JWE/JWS. Another approach here would be to address the JSON and compact forms separately. The JSON form has no need of "typ" at all, since the type of the object is completely clear from what fields are there, e.g., "recipients" vs. "signatures". For the compact form, we could do something like James's "E."/"S." prefix idea, which you need because the dot-separated components have different meanings and no field names to indicate this. --Richard On Wed, May 29, 2013 at 8:30 PM, Mike Jones <Michael.Jones@microsoft.com>wrote: > A standard library is unlikely to know the meanings of all possible > “typ” values – and more to the point, *it doesn’t have to*. It’s the > application’s job to determine that “this blob is a JOSE object” and then > pass it to a standard library, which will then ignore the “typ” value.**** > > ** ** > > A standard JOSE library won’t know what “typ”: “JWT” means. It won’t know > what “typ”: “BCGovToken” is, should the BC Government want to declare that > it’s using a token with particular characteristics. It won’t know what > “typ”: “XMPP” is, should XMPP want to declare that it’s using a JOSE data > structure with particular characteristics. Etc.**** > > ** ** > > All these values can be registered in the registry and used by > applications that understand them. That’s the application’s job – not the > library’s job. The “typ” field is just there so that applications have a > standard place to make any such declarations that they may need.**** > > ** ** > > -- Mike*** > * > > ** ** > > *From:* Dick Hardt [mailto:dick.hardt@gmail.com] > *Sent:* Wednesday, May 29, 2013 5:18 PM > *To:* Mike Jones > *Cc:* Jim Schaad; jose@ietf.org > > *Subject:* Re: [jose] Should we delete the "typ" header field**** > > ** ** > > I'd prefer to be able to use standard libraries for creating and parsing > tokens, and not specialized libraries dependent on the use case.**** > > ** ** > > I strongly think we either drop "typ" or make it required.**** > > ** ** > > On Wed, May 29, 2013 at 5:03 PM, Mike Jones <Michael.Jones@microsoft.com> > wrote:**** > > It’s fine for your application to specify that it’s required for your use > case. Not applications need it, so they shouldn’t be forced to pay the > space penalty of an unnecessary field.**** > > **** > > -- Mike*** > * > > **** > > *From:* jose-bounces@ietf.org [mailto:jose-bounces@ietf.org] *On Behalf > Of *Dick Hardt > *Sent:* Wednesday, May 29, 2013 4:56 PM**** > > > *To:* Jim Schaad > *Cc:* jose@ietf.org > *Subject:* Re: [jose] Should we delete the "typ" header field**** > > **** > > I use it all the time and my code would barf if it was not there.**** > > **** > > I think it should be required rather than be a hint if it is going ot be > there.**** > > **** > > On Wed, May 29, 2013 at 4:40 PM, Jim Schaad <ietf@augustcellars.com> > wrote:**** > > I think the values just changed**** > > **** > > However the way you are using it would be an argument to say that it > should be a required field. Are you just using it as a hint if it exists > and then looking at the rest of the fields if it is not present?**** > > **** > > Jim**** > > **** > > **** > > *From:* Dick Hardt [mailto:dick.hardt@gmail.com] > *Sent:* Wednesday, May 29, 2013 3:49 PM > *To:* Jim Schaad > *Cc:* jose@ietf.org > *Subject:* Re: [jose] Should we delete the "typ" header field**** > > **** > > Well, I have been using, but now realize the spec changed or I was > confused.**** > > **** > > I had been setting "typ" to be either "JWE" or "JWS" depending on the type > of token I was creating or parsing as it was easier than looking at "alg"* > *** > > **** > > As currently defined, I don't see value in "typ".**** > > **** > > -- Dick**** > > **** > > **** > > On Wed, May 29, 2013 at 3:02 PM, Jim Schaad <ietf@augustcellars.com> > wrote:**** > > In reading the documents, I am trying to understand the justification for > having the “typ” header parameter in the JOSE documents.**** > > **** > > The purpose of the field is to hold the type of the object. In the past, > I believe that values which should now be placed in the cty field (such as > “JWT”) were placed in this field as well. However the parameter is > optional and an implementation cannot rely on its being present. This > means that for all practical purposes all of the code to determine the > value of the type field from the values of the alg and enc fields. If the > field was mandatory then this code would disappear at a fairly small space > cost and I can understand why the parameter would be present.**** > > **** > > Can anybody justify why this field should be present in the document – or > should it just disappear?**** > > **** > > Jim**** > > **** > > > _______________________________________________ > jose mailing list > jose@ietf.org > https://www.ietf.org/mailman/listinfo/jose**** > > > > **** > > **** > > -- > -- Dick **** > > > > **** > > **** > > -- > -- Dick **** > > > _______________________________________________ > jose mailing list > jose@ietf.org > https://www.ietf.org/mailman/listinfo/jose**** > > > > **** > > ** ** > > -- > -- Dick **** > > _______________________________________________ > jose mailing list > jose@ietf.org > https://www.ietf.org/mailman/listinfo/jose > >
- [jose] Should we delete the "typ" header field Jim Schaad
- Re: [jose] Should we delete the "typ" header field Richard Barnes
- Re: [jose] Should we delete the "typ" header field Dick Hardt
- Re: [jose] Should we delete the "typ" header field Mike Jones
- Re: [jose] Should we delete the "typ" header field Jim Schaad
- Re: [jose] Should we delete the "typ" header field Jim Schaad
- Re: [jose] Should we delete the "typ" header field Jim Schaad
- Re: [jose] Should we delete the "typ" header field Mike Jones
- Re: [jose] Should we delete the "typ" header field Dick Hardt
- Re: [jose] Should we delete the "typ" header field Mike Jones
- Re: [jose] Should we delete the "typ" header field Dick Hardt
- Re: [jose] Should we delete the "typ" header field John Bradley
- Re: [jose] Should we delete the "typ" header field Dick Hardt
- Re: [jose] Should we delete the "typ" header field Mike Jones
- Re: [jose] Should we delete the "typ" header field Mike Jones
- Re: [jose] Should we delete the "typ" header field John Bradley
- Re: [jose] Should we delete the "typ" header field John Bradley
- Re: [jose] Should we delete the "typ" header field Dick Hardt
- Re: [jose] FW: Should we delete the "typ" header … Richard Barnes
- Re: [jose] Should we delete the "typ" header field Mike Jones
- Re: [jose] Should we delete the "typ" header field Jim Schaad
- Re: [jose] Should we delete the "typ" header field John Bradley
- Re: [jose] Should we delete the "typ" header field Mike Jones
- Re: [jose] Should we delete the "typ" header field John Bradley
- Re: [jose] Should we delete the "typ" header field Richard Barnes
- Re: [jose] Should we delete the "typ" header field Mike Jones
- Re: [jose] Should we delete the "typ" header field Manger, James H
- Re: [jose] Should we delete the "typ" header field Mike Jones
- [jose] FW: Should we delete the "typ" header field Manger, James H
- Re: [jose] FW: Should we delete the "typ" header … Mike Jones
- Re: [jose] FW: Should we delete the "typ" header … Manger, James H
- Re: [jose] Should we delete the "typ" header field Richard Barnes
- Re: [jose] Should we delete the "typ" header field Richard Barnes
- Re: [jose] Should we delete the "typ" header field Mike Jones
- Re: [jose] Should we delete the "typ" header field Jim Schaad
- Re: [jose] Should we delete the "typ" header field Jim Schaad
- Re: [jose] Should we delete the "typ" header field Richard Barnes
- Re: [jose] Should we delete the "typ" header field Mike Jones
- Re: [jose] Should we delete the "typ" header field Richer, Justin P.
- Re: [jose] Should we delete the "typ" header field Nat Sakimura
- Re: [jose] Should we delete the "typ" header field John Bradley
- Re: [jose] Should we delete the "typ" header field Jim Schaad
- Re: [jose] Should we delete the "typ" header field Dick Hardt
- Re: [jose] Should we delete the "typ" header field Richard Barnes
- Re: [jose] Should we delete the "typ" header field Anthony Nadalin
- Re: [jose] Should we delete the "typ" header field Richard Barnes
- Re: [jose] Should we delete the "typ" header field Mike Jones
- Re: [jose] Should we delete the "typ" header field Nat Sakimura
- Re: [jose] Should we delete the "typ" header field Brian Campbell
- Re: [jose] Should we delete the "typ" header field Richard Barnes
- Re: [jose] Should we delete the "typ" header field Nat Sakimura
- Re: [jose] Should we delete the "typ" header field Richard Barnes
- Re: [jose] Should we delete the "typ" header field Nat Sakimura
- Re: [jose] Should we delete the "typ" header field Dick Hardt
- Re: [jose] Should we delete the "typ" header field Nat Sakimura
- Re: [jose] Should we delete the "typ" header field Manger, James H
- Re: [jose] Should we delete the "typ" header field Axel.Nennker
- Re: [jose] Should we delete the "typ" header field Jim Schaad
- Re: [jose] Should we delete the "typ" header field Mike Jones
- Re: [jose] Should we delete the "typ" header field Richard Barnes
- Re: [jose] FW: Should we delete the "typ" header … Mike Jones
- Re: [jose] FW: Should we delete the "typ" header … Manger, James H
- Re: [jose] FW: Should we delete the "typ" header … Mike Jones
- Re: [jose] FW: Should we delete the "typ" header … Richard Barnes
- Re: [jose] FW: Should we delete the "typ" header … Mike Jones
- Re: [jose] FW: Should we delete the "typ" header … Jim Schaad
- Re: [jose] FW: Should we delete the "typ" header … Mike Jones
- Re: [jose] FW: Should we delete the "typ" header … Manger, James H