Re: [jose] Minutes

Fixed title of issue in tracker.

On Mon, Mar 25, 2013 at 6:56 PM, Mike Jones <Michael.Jones@microsoft.com>wrote:

>  “Impossible to separate wrapped key from encrypted data” (the title of
> issue #4) is a false statement.  Nat pointed that out over a month ago in
> the issue tracker.  If that remains the title of the issue, it should be
> closed on the merits of the issue.****
>
> ** **
>
> If you want to change the title of this one to “Should the encrypted key
> element of a JWE no longer be included in the integrity check?” I’d have no
> problem with the issue, because then it would be making a neutral statement
> about a possible change.  But right now, it’s highly misleading, at best.*
> ***
>
> ** **
>
> None of that was captured in the minutes, even though it was all discussed
> in Orlando.****
>
> ** **
>
>                                                             -- Mike****
>
> ** **
>
> *From:* jose-bounces@ietf.org [mailto:jose-bounces@ietf.org] *On Behalf
> Of *Richard Barnes
> *Sent:* Monday, March 25, 2013 3:11 PM
> *To:* Mike Jones
> *Cc:* Jim Schaad; jose@ietf.org
> *Subject:* Re: [jose] Minutes****
>
> ** **
>
> It's not accurate to say that Issue #4 is not a problem.  We did clarify
> in the meeting that the issue could use some re-statement, to clarify that
> the issue is the coverage of keys by the integrity check.  So there's still
> an issue, namely whether the key needs to be covered by the integrity check.
> ****
>
> ** **
>
> ** **
>
> On Sun, Mar 24, 2013 at 9:02 PM, Mike Jones <Michael.Jones@microsoft.com>
> wrote:****
>
> I don’t believe that the minutes adequately capture the discussion on
> issue #4 (http://trac.tools.ietf.org/wg/jose/trac/ticket/4#<http://trac.tools.ietf.org/wg/jose/trac/ticket/4>).
> I would revise as follows:****
>
>  ****
>
> Data tracker issue #4 (Impossible to separate wrapped key from encrypted
> data) – John Bradley’s slides pointed out that it **is** possible to
> separate wrapped keys from encrypted data when needed by using the direct
> encryption mode and therefore asked for this issue to be closed, as it is
> based upon a false premise.  Mike Jones also asked for this to be closed on
> this basis, and pointed out that Nat Sakimura had already described the
> problem with this issue in the issue tracker.  Richard asked a question
> about the security analysis of including the wrapped key in the integrity
> calculation - Does the wrapped key need to be included in the integrity
> check or not?  The question will be referred to CFRG but a request for
> possible attack modes being sent to the list is requested.****
>
>  ****
>
> Given that the problem stated in issue #4 was demonstrated to not actually
> be a problem during the discussions, I would ask again that the chairs
> close this one, and update the minutes to reflect this.****
>
>  ****
>
>                                                             Thank you,****
>
>                                                             -- Mike****
>
>  ****
>
> *From:* jose-bounces@ietf.org [mailto:jose-bounces@ietf.org] *On Behalf
> Of *Jim Schaad
> *Sent:* Friday, March 22, 2013 1:12 PM
> *To:* jose@ietf.org
> *Subject:* [jose] Minutes****
>
>  ****
>
> Preliminary minutes have been uploaded to the site.  Please review and
> comment back to me if you have disagreements.****
>
>  ****
>
> http://www.ietf.org/proceedings/86/minutes/minutes-86-jose****
>
>  ****
>
> Note that the minutes have an action list at the bottom of them.****
>
>  ****
>
> Jim****
>
>  ****
>
>
> _______________________________________________
> jose mailing list
> jose@ietf.org
> https://www.ietf.org/mailman/listinfo/jose****
>
> ** **
>