Re: [jose] Stephen Farrell's No Objection on draft-ietf-jose-json-web-signature-33: (with COMMENT)

Mike Jones <Michael.Jones@microsoft.com> Mon, 06 October 2014 07:54 UTC

Return-Path: <Michael.Jones@microsoft.com>
X-Original-To: jose@ietfa.amsl.com
Delivered-To: jose@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C381A1A1B75; Mon, 6 Oct 2014 00:54:53 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.902
X-Spam-Level:
X-Spam-Status: No, score=-1.902 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8I0V2m4USBfW; Mon, 6 Oct 2014 00:54:48 -0700 (PDT)
Received: from na01-by2-obe.outbound.protection.outlook.com (mail-by2on0144.outbound.protection.outlook.com [207.46.100.144]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6504E1A1B69; Mon, 6 Oct 2014 00:54:48 -0700 (PDT)
Received: from CH1PR03CA011.namprd03.prod.outlook.com (10.255.156.156) by BY1PR0301MB1207.namprd03.prod.outlook.com (25.161.203.156) with Microsoft SMTP Server (TLS) id 15.0.1044.10; Mon, 6 Oct 2014 07:54:46 +0000
Received: from BY2FFO11FD034.protection.gbl (10.255.156.132) by CH1PR03CA011.outlook.office365.com (10.255.156.156) with Microsoft SMTP Server (TLS) id 15.0.1044.10 via Frontend Transport; Mon, 6 Oct 2014 07:54:46 +0000
Received: from mail.microsoft.com (131.107.125.37) by BY2FFO11FD034.mail.protection.outlook.com (10.1.14.219) with Microsoft SMTP Server (TLS) id 15.0.1039.16 via Frontend Transport; Mon, 6 Oct 2014 07:54:45 +0000
Received: from TK5EX14MBXC286.redmond.corp.microsoft.com ([169.254.1.93]) by TK5EX14HUBC104.redmond.corp.microsoft.com ([157.54.80.25]) with mapi id 14.03.0210.003; Mon, 6 Oct 2014 07:54:13 +0000
From: Mike Jones <Michael.Jones@microsoft.com>
To: Stephen Farrell <stephen.farrell@cs.tcd.ie>, The IESG <iesg@ietf.org>
Thread-Topic: Stephen Farrell's No Objection on draft-ietf-jose-json-web-signature-33: (with COMMENT)
Thread-Index: AQHP3jUXN4SFuPVAqk+azeH6df9DHZwiQVag
Date: Mon, 06 Oct 2014 07:54:12 +0000
Message-ID: <4E1F6AAD24975D4BA5B16804296739439BAF0C23@TK5EX14MBXC286.redmond.corp.microsoft.com>
References: <20141002113537.6338.90088.idtracker@ietfa.amsl.com>
In-Reply-To: <20141002113537.6338.90088.idtracker@ietfa.amsl.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-originating-ip: [157.54.51.33]
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: base64
MIME-Version: 1.0
X-EOPAttributedMessage: 0
X-Forefront-Antispam-Report: CIP:131.107.125.37; CTRY:US; IPV:CAL; IPV:NLI; IPV:NLI; EFV:NLI; SFV:NSPM; SFS:(10019020)(6009001)(438002)(13464003)(52044002)(199003)(43784003)(69234005)(52604005)(51704005)(189002)(377454003)(87936001)(85852003)(46102003)(85806002)(106116001)(76176999)(2656002)(15202345003)(33656002)(23676002)(106466001)(50986999)(86362001)(81156004)(95666004)(92726001)(26826002)(19580395003)(80022003)(55846006)(54356999)(4396001)(104016003)(92566001)(47776003)(68736004)(69596002)(20776003)(85306004)(230783001)(10300001)(86612001)(64706001)(15975445006)(31966008)(77096002)(21056001)(120916001)(107046002)(50466002)(6806004)(99396003)(97736003)(19580405001)(44976005)(66066001)(76482002)(84676001); DIR:OUT; SFP:1102; SCL:1; SRVR:BY1PR0301MB1207; H:mail.microsoft.com; FPR:; MLV:ovrnspm; PTR:InfoDomainNonexistent; A:1; MX:1; LANG:en;
X-Microsoft-Antispam: UriScan:;
X-Microsoft-Antispam: BCL:0;PCL:0;RULEID:;SRVR:BY1PR0301MB1207;
X-O365ENT-EOP-Header: Message processed by - O365_ENT: Allow from ranges (Engineering ONLY)
X-Forefront-PRVS: 03569407CC
Received-SPF: Pass (protection.outlook.com: domain of microsoft.com designates 131.107.125.37 as permitted sender) receiver=protection.outlook.com; client-ip=131.107.125.37; helo=mail.microsoft.com;
Authentication-Results: spf=pass (sender IP is 131.107.125.37) smtp.mailfrom=Michael.Jones@microsoft.com;
X-OriginatorOrg: microsoft.onmicrosoft.com
Archived-At: http://mailarchive.ietf.org/arch/msg/jose/xWvfgbqquRmrFKy-D7EJwQElHHY
Cc: "jose-chairs@tools.ietf.org" <jose-chairs@tools.ietf.org>, "jose@ietf.org" <jose@ietf.org>, "draft-ietf-jose-json-web-signature@tools.ietf.org" <draft-ietf-jose-json-web-signature@tools.ietf.org>
Subject: Re: [jose] Stephen Farrell's No Objection on draft-ietf-jose-json-web-signature-33: (with COMMENT)
X-BeenThere: jose@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Javascript Object Signing and Encryption <jose.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/jose>, <mailto:jose-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/jose/>
List-Post: <mailto:jose@ietf.org>
List-Help: <mailto:jose-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/jose>, <mailto:jose-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 06 Oct 2014 07:54:54 -0000

Thanks for your review, Stephen.  I'm adding the working group to the thread so they're aware of your comments.

> -----Original Message-----
> From: Stephen Farrell [mailto:stephen.farrell@cs.tcd.ie]
> Sent: Thursday, October 02, 2014 4:36 AM
> To: The IESG
> Cc: jose-chairs@tools.ietf.org; draft-ietf-jose-json-web-
> signature@tools.ietf.org
> Subject: Stephen Farrell's No Objection on draft-ietf-jose-json-web-signature-
> 33: (with COMMENT)
> 
> Stephen Farrell has entered the following ballot position for
> draft-ietf-jose-json-web-signature-33: No Objection
> 
> When responding, please keep the subject line intact and reply to all email
> addresses included in the To and CC lines. (Feel free to cut this introductory
> paragraph, however.)
> 
> 
> Please refer to http://www.ietf.org/iesg/statement/discuss-criteria.html
> for more information about IESG DISCUSS and COMMENT positions.
> 
> 
> The document, along with other ballot positions, can be found here:
> http://datatracker.ietf.org/doc/draft-ietf-jose-json-web-signature/
> 
> 
> 
> ----------------------------------------------------------------------
> COMMENT:
> ----------------------------------------------------------------------
> 
> 
> no-obj
> 
> I think Pete is wrong about section 8 and would DISCUSS its
> removal;-) Its needed for jku handling.

Thanks for weighing in.  FYI, it's also needed for x5u handling.  I'll make sure that the wording appropriately scopes the requirements.

> 4.1.2: TLS server auth is good here, but only makes sense if the jku parameter
> itself was signed and there wasn't any odd HTTP 3xx re-direction and/or if the
> authority in the jku value is reflected in the subject or SAN of the TLS server cert.
> Why is it ok to not include such detail? Is all of that correct and appropriate in
> 6125 (which I see you reference from section 9)

Yes, I believe that this is handled by 6125, which is a virtual treatise on how to do this right.

> 4.1.4: why isn't this case-sensitive still as in JWKs?  (Is that a result of lots of
> copied text over >1 draft?)

Good catch - thanks

> 4.1.5-4.1.8: If all of that text is replicated elsewhere it should only be included in
> one and cross-referenced.

It is cross-referenced in JWE Sections 4.1.7-4.1.10, rather than being duplicated.  (It used to be duplicated, but we fixed that a while back.)

				Thanks again,
				-- Mike