From: Mike Jones <Michael.Jones@microsoft.com>
To: Pete Resnick <presnick@qti.qualcomm.com>
Thread-Topic: [jose] Pete Resnick's Discuss on
 draft-ietf-jose-json-web-signature-33: (with DISCUSS and COMMENT)
Thread-Index: AQHP3fdK8YG+SRr1nECfcW20xykmgJwgtxPQgAJQ0QCAARwqgIArdnkAgARaq4CAFM/YYIAAQMgg
Date: Thu, 20 Nov 2014 01:25:49 +0000
Message-ID: <4E1F6AAD24975D4BA5B16804296739439BB8DC90@TK5EX14MBXC286.redmond.corp.microsoft.com>
References: <20141002041344.8073.81288.idtracker@ietfa.amsl.com>
 <4E1F6AAD24975D4BA5B16804296739439BAEBD05@TK5EX14MBXC286.redmond.corp.microsoft.com>
 <008a01cfe161$f0ec5090$d2c4f1b0$@augustcellars.com>
 <4E1F6AAD24975D4BA5B16804296739439BAF370A@TK5EX14MBXC286.redmond.corp.microsoft.com>
 <CAHbuEH4dWUcUnP5_+w5tGY7eS0HKbu8Jr3WDVoq4s1eYvct8xA@mail.gmail.com>
 <545B9763.9050004@qti.qualcomm.com>
 <4E1F6AAD24975D4BA5B16804296739439BB8CF5A@TK5EX14MBXC286.redmond.corp.microsoft.com>
In-Reply-To: <4E1F6AAD24975D4BA5B16804296739439BB8CF5A@TK5EX14MBXC286.redmond.corp.microsoft.com>
Accept-Language: en-US
Content-Language: en-US
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Received-SPF: Pass (protection.outlook.com: domain of microsoft.com designates
 131.107.125.37 as permitted sender)
 receiver=protection.outlook.com; 
 client-ip=131.107.125.37; helo=mail.microsoft.com;
Archived-At: http://mailarchive.ietf.org/arch/msg/jose/stqozfpJETTALWAacMD6r3y9gz0
Cc: "jose-chairs@tools.ietf.org" <jose-chairs@tools.ietf.org>,
 Jim Schaad <ietf@augustcellars.com>,
 Kathleen Moriarty <kathleen.moriarty.ietf@gmail.com>, The IESG <iesg@ietf.org>,
 "jose@ietf.org" <jose@ietf.org>,
 "draft-ietf-jose-json-web-signature@tools.ietf.org"
 <draft-ietf-jose-json-web-signature@tools.ietf.org>
Subject: Re: [jose] Pete Resnick's Discuss on
 draft-ietf-jose-json-web-signature-33: (with DISCUSS and COMMENT)
Precedence: list

This resolution is incorporated in the -37 drafts.

				-- Mike

-----Original Message-----
From: jose [mailto:jose-bounces@ietf.org] On Behalf Of Mike Jones
Sent: Wednesday, November 19, 2014 1:49 PM
To: Pete Resnick
Cc: jose-chairs@tools.ietf.org; Jim Schaad; Kathleen Moriarty; The IESG; jo=
se@ietf.org; draft-ietf-jose-json-web-signature@tools.ietf.org
Subject: Re: [jose] Pete Resnick's Discuss on draft-ietf-jose-json-web-sign=
ature-33: (with DISCUSS and COMMENT)

Below I'm responding only to the remaining issue about "rejecting JWSs".   =
Pete, please let me know if the proposed language works for you.

> >>>>> 5.2:
> >>>>>
> >>>>> Strike the last sentence of the second paragraph. There's no=20
> >>>>> requirement here. If none of them validate, I can do what I want=20
> >>>>> with the JWS. I needn't "reject" it. I might just mark it as "inval=
id".
> >>>>>
> >>>>> [Get rid of all talk of "rejecting" throughout this document.
> >>>>> Again, I will note that the signatures are not valid, but=20
> >>>>> rejecting is a local implementation detail.]
> >>>>>
> >>>> As discussed during the telechat and on subsequent threads, the=20
> >>>> terms "accept" and "reject" are commonly used in this way, for=20
> >>>> instance, in RFC 5820.  As Kathleen wrote after the call, "For=20
> >>>> the
> "reject"
> >>>> language, Pete said on the call that he would go through each one=20
> >>>> to see where it might be application specific and will suggest chang=
es.
> >>>> Thanks in advance, Pete.".
> >>>>
>=20
> So I've gone through all of the "reject"s in the document, and I think=20
> I see a way to allay my concern without significantly changing the
> language: Instead of saying "reject the JWS" as it does in most=20
> places, I believe it would be much clearer if it simply said "reject=20
> the signature" as it does in 4.1.6. Then you're clearly not saying=20
> "rejecting the data", as I'm afraid certain sorts of applications=20
> developers will interpret it. In some instances, you'll need to say=20
> something like "reject the signature of a JWS with foobar", but I don't t=
hink that significantly changes the intended meaning.

It turns out that way back in draft -15, in response to issue #35 (http://t=
rac.tools.ietf.org/wg/jose/trac/ticket/35), we'd already changed statements=
 about "rejecting the JWS" in contexts of signature failures to statements =
about  the JWS Signature being invalid.  So those uses of "reject the JWS" =
that remained were actually about rejecting the whole thing - not about rej=
ecting the signature.  I'm revisiting that history because your suggested l=
anguage about "reject the signature" doesn't actually convey the correct me=
aning in the remaining contexts.

But I understand and agree with your intent - which is to say that implemen=
tations will determine that some JWSs are invalid, rather than the "rejecti=
on" being some kind of cataclysmic failure.  To achieve this intent, I've i=
nstead changed the language "reject the JWS" to "consider the JWS to be inv=
alid" in my current editor's draft.  Let me know if that works for you.

I've made the parallel changes in the JWE draft as well.

				Thanks again,
				-- Mike

_______________________________________________
jose mailing list
jose@ietf.org
https://www.ietf.org/mailman/listinfo/jose