Re: [jose] JWK member names, was: SECDIR review of draft-ietf-jose-json-web-key-31

[Tim Bray <[e-mail]>]

On Tue, Sep 16, 2014 at 1:07 PM, Stephen Kent <[e-mail]> wrote:

> What is the impediment to requiring a receiver of a JWK object to reject
> the object if
> it contains more than one instance of a key?
>
> Is it a limitation of a parser that are completely independent of the JOSE
> work that defines
> the JWK objects, or is it the result of how folks have written code to
> parse such objects?
>

​Yes and no, respectively.  Existing parsers which are being used all the
time on every computing device within your reach to generate and parse JSON
for purposes which have nothing to with JOSE.  JSON has been the dominant
message format for HTTP for some time now.




>
> If the answer is the first clause, then I understand the reluctance to
> impose that requirement.
>
> If the answer is the latter, then this is an argument based on early
> implementation
> of an IETF spec, and that is not an good reason to accommodate such
> sloppiness.
>
> Steve
>



-- 
- Tim Bray (If you’d like to send me a private message, see
https://keybase.io/timbray)