IETF Logo Mail Archive

Re: [OAUTH-WG] More Criticism of JOSE

Mike Jones <Michael.Jones@microsoft.com> Wed, 15 March 2017 19:50 UTC

Return-Path: <Michael.Jones@microsoft.com>
X-Original-To: oauth@ietfa.amsl.com
Delivered-To: oauth@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4DC0113170E for <oauth@ietfa.amsl.com>; Wed, 15 Mar 2017 12:50:06 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.021
X-Spam-Level:
X-Spam-Status: No, score=-2.021 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Xe18YZhCrlo4 for <oauth@ietfa.amsl.com>; Wed, 15 Mar 2017 12:50:04 -0700 (PDT)
Received: from NAM03-BY2-obe.outbound.protection.outlook.com (mail-by2nam03on0108.outbound.protection.outlook.com [104.47.42.108]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 02F0A1316A7 for <oauth@ietf.org>; Wed, 15 Mar 2017 12:50:03 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=rCGvBoBCcR/nNLWwt1qlYimSl9ENA47vowpclfSrGPs=; b=Z8TIPHvr/x6nbxu2babLXUKUA3nham5xQnjdkmKNuJ+OnFv0UCeUp573pJS8nLD9rtwH9R+hWtRMNa7HGvbA0kKnBXuk5jxHHo7v0aj2Pw8Y77EOuljd3/WwS5KH+qPPfhfOuW/NFE8/8EaT2eWAVBzukTAjf0W9dI7wh3flQRs=
Received: from CY4PR21MB0504.namprd21.prod.outlook.com (10.172.122.14) by CY4PR21MB0502.namprd21.prod.outlook.com (10.172.122.12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.991.0; Wed, 15 Mar 2017 19:50:02 +0000
Received: from CY4PR21MB0504.namprd21.prod.outlook.com ([10.172.122.14]) by CY4PR21MB0504.namprd21.prod.outlook.com ([10.172.122.14]) with mapi id 15.01.0991.003; Wed, 15 Mar 2017 19:50:02 +0000
From: Mike Jones <Michael.Jones@microsoft.com>
To: Sergey Beryozkin <sberyozkin@gmail.com>, "oauth@ietf.org" <oauth@ietf.org>
Thread-Topic: [OAUTH-WG] More Criticism of JOSE
Thread-Index: AQHSnaLc8rEEDhIYtU+PeFy9Q2RU+KGWC1EAgABCAdA=
Date: Wed, 15 Mar 2017 19:50:02 +0000
Message-ID: <CY4PR21MB0504F80C01BF3378DE3794C6F5270@CY4PR21MB0504.namprd21.prod.outlook.com>
References: <mailman.539.1489455092.6649.oauth@ietf.org> <de3bdfc3f87fad59432f85f75db3d6b4@gluu.org> <814591e4-c21a-451b-cce9-e4f158f07c2e@gmail.com>
In-Reply-To: <814591e4-c21a-451b-cce9-e4f158f07c2e@gmail.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
authentication-results: gmail.com; dkim=none (message not signed) header.d=none;gmail.com; dmarc=none action=none header.from=microsoft.com;
x-originating-ip: [2001:4898:80e8:4::36]
x-microsoft-exchange-diagnostics: 1; CY4PR21MB0502; 7:HcSlMPVtg2vcnKPiPOdJyG0vCwmlZSG4wO0Q62qUNU7xauNRbplzqyupCO+e+z3elWO+dVvsDLjtgJdIhySWt4A3RitsOGqL1mAZ+c065vGz1VP/domV3i9llOHyJ0D4MYwhmGVPo+i2A1A/WesQubU/Q+InCPtubnl5rhFlwj3PwWb08OXJiCbtzzD7iJd+bXbvtrArDscUJuUobUUim1SWUNbXKsi6c2OTmr5LPSOI7UStRR4ROxkrygzLyxDsJsfs9UiThDUq1sGwCAQS/NIzMcW5BCIqUCu+1+m53UDbjJAmnv9XrlkyFpetVsut1AinurLJO9kcyd989M69oIxv6jgE5zV5hvGQBiL/Pjo=
x-ms-office365-filtering-correlation-id: 302498fc-1780-4909-672b-08d46bdc78b2
x-ms-office365-filtering-ht: Tenant
x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(2017030254024)(48565401081); SRVR:CY4PR21MB0502;
x-microsoft-antispam-prvs: <CY4PR21MB050234D437972AF2C531484DF5270@CY4PR21MB0502.namprd21.prod.outlook.com>
x-exchange-antispam-report-test: UriScan:(278428928389397)(192374486261705);
x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(61425038)(6040375)(601004)(2401047)(5005006)(8121501046)(3002001)(93006012)(93001012)(10201501046)(6055026)(61426038)(61427038)(6041248)(20161123555025)(20161123562025)(20161123560025)(20161123558025)(20161123564025)(6072148); SRVR:CY4PR21MB0502; BCL:0; PCL:0; RULEID:; SRVR:CY4PR21MB0502;
x-forefront-prvs: 02475B2A01
x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(6009001)(39450400003)(39850400002)(39860400002)(39840400002)(39410400002)(13464003)(377454003)(24454002)(53824002)(7696004)(38730400002)(189998001)(5660300001)(122556002)(53546007)(8990500004)(77096006)(5005710100001)(25786008)(10290500002)(6506006)(2906002)(2950100002)(2501003)(6436002)(229853002)(6246003)(86362001)(8936002)(39060400002)(2900100001)(53936002)(33656002)(8676002)(9686003)(3660700001)(6306002)(7736002)(81166006)(55016002)(86612001)(50986999)(54356999)(76176999)(3280700002)(102836003)(10090500001)(74316002)(6116002)(99286003)(305945005); DIR:OUT; SFP:1102; SCL:1; SRVR:CY4PR21MB0502; H:CY4PR21MB0504.namprd21.prod.outlook.com; FPR:; SPF:None; MLV:ovrnspm; PTR:InfoNoRecords; LANG:en;
spamdiagnosticoutput: 1:99
spamdiagnosticmetadata: NSPM
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-OriginatorOrg: microsoft.com
X-MS-Exchange-CrossTenant-originalarrivaltime: 15 Mar 2017 19:50:02.6886 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY4PR21MB0502
Archived-At: <https://mailarchive.ietf.org/arch/msg/oauth/7g4WEyo0eTQ4cNXqgAcO5kUG1Fo>
Subject: Re: [OAUTH-WG] More Criticism of JOSE
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/oauth/>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 15 Mar 2017 19:50:06 -0000

The bulk of this seems to be about applications that don't verify that the crypto algorithms that were used in a JWT are acceptable in the application context.  While I know that some people would like crypto to be magic pixie dust that you can sprinkle on an application to get crypto goodness, it will never be that simple.  Crypto algorithms that are thought to be good today will be deprecated later.  Apps that keep allowing them to be used will be vulnerable.  The JOSE specs requiring that applications be aware of the algorithms used is a good and necessary thing for long-term security - not a problem with the specs.

That said, of course some implementers will get things wrong.  To the extent that we can help them understand what they actually need to do to use the specifications securely, we obviously should.  Perhaps we should write an article for oauth.net talking about some of these issues?  Maybe a few of us can get together in Chicago and work on that.

I'm looking forward to seeing many of you in 1.5 weeks!

				-- Mike

-----Original Message-----
From: OAuth [mailto:oauth-bounces@ietf.org] On Behalf Of Sergey Beryozkin
Sent: Wednesday, March 15, 2017 8:46 AM
To: oauth@ietf.org
Subject: Re: [OAUTH-WG] More Criticism of JOSE

and everyone should now start using the most secure alternative proposed in that very light in analysis article :-)

Sergey
On 15/03/17 15:43, Mike Schwartz wrote:
> Sorry to be the bearer of bad news, but here's a negative review of JOSE:
>
> JOSE (Javascript Object Signing and Encryption) is a Bad Standard That 
> Everyone Should Avoid
>
> https://paragonie.com/blog/2017/03/jwt-json-web-tokens-is-bad-standard
> -that-everyone-should-avoid
>
>
> - Mike
>
> _______________________________________________
> OAuth mailing list
> OAuth@ietf.org
> https://www.ietf.org/mailman/listinfo/oauth

_______________________________________________
OAuth mailing list
OAuth@ietf.org
https://www.ietf.org/mailman/listinfo/oauth

v2.23.0 | Report a Bug | By Email