Re: [jose] Issues with the WG documents

"Jim Schaad" <ietf@augustcellars.com> Mon, 21 July 2014 15:59 UTC

From: Jim Schaad <ietf@augustcellars.com>
To: 'Massimiliano Pala' <director@openca.org>, jose@ietf.org
References: <53CD2D56.4010604@openca.org>
In-Reply-To: <53CD2D56.4010604@openca.org>
Date: Mon, 21 Jul 2014 11:56:52 -0400
Message-ID: <0a2e01cfa4fc$6586f150$3094d3f0$@augustcellars.com>
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="----=_NextPart_000_0A2F_01CFA4DA.DE777430"
Thread-Index: AQF0YsbrEUMga8kAbz+wTO0a0JDy2JxhMmXQ
Content-Language: en-us
Archived-At: http://mailarchive.ietf.org/arch/msg/jose/tWsDaSVESSuXd5rzeSp0iekMmjc
Subject: Re: [jose] Issues with the WG documents
Precedence: list

From: jose [mailto:jose-bounces@ietf.org] On Behalf Of Massimiliano Pala
Sent: Monday, July 21, 2014 11:10 AM
To: jose@ietf.org
Subject: [jose] Issues with the WG documents

Hello Jose WG,

I just review the WG document in the effort of understanding the features
that are being addressed and the inter-WG possible interoperability
capabilities and / or issues. I have to apologize for not being able to
participate to the WG efforts before.

Unfortunately, it seems (IMHO) that much of the previous work that has been
done in the security area, most noticeable by the PKIX WG, has been
practically ignored. In particular (and please forget me if I am raising
points that have already been addressed in the past - if so, please provide
me with references so that I can understand these choices), here's the
overall general issues that I found throughout the documents:

*	Duplication of Registration for Algorithm Identifiers
(cross-application). This is particularly bad because the use of text
identifiers (even if it is specified that they should be unique), might be
"overloaded" in their usage because of the chosen names. Those identifiers
(as today written in the docs) are similar to the description, rather than
IDs
*	Format-Dependent content protection - This seems to be an
over-engineering of the format where not needed - i.e., content is content,
not JSON without spaces on one line content.
*	Algorithm Agility - I find it odd that, with all the work that has
been done in the past for moving from specifying algorithm to providing
specs for extensible algorithms field has been ignored (e.g., fixed SHA-1
and SHA-256 specification for certificate identifiers
*	Interoperability with PKIX formats. No effort, AFAIK, has been done
(at least reflected in the documents) about format translation from the
structures used from the PKIX group into JSON - that would provide a more
useful tool for integrating JSON into existing cryptographic libraries (ease
of deployment and format interoperability)

This work would be out of scope for the JOSE working group.  The documents
more closely correspond to those found in the CMS work from the S/MIME
working group than anything found in PKIX. 

Jim

Last, I found it very weird the following notation:

    ASCII(BASE64(.))

since the BASE64 is an ASCII representation, what does the ASCII() specs
mean in this case and why it is needed?

Best Regards,
Dr. Pala

[jose] Issues with the WG documents Massimiliano Pala
Re: [jose] Issues with the WG documents Jim Schaad