Re: [OAUTH-WG] draft-ietf-oauth-json-web-token-19 - Examples

Brian Campbell <bcampbell@pingidentity.com> Fri, 25 April 2014 14:22 UTC

Return-Path: <bcampbell@pingidentity.com>
X-Original-To: oauth@ietfa.amsl.com
Delivered-To: oauth@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 49E381A022E for <oauth@ietfa.amsl.com>; Fri, 25 Apr 2014 07:22:57 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -0.389
X-Spam-Level:
X-Spam-Status: No, score=-0.389 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FM_FORGED_GMAIL=0.622, FR_TEST_BASE64_BAD=3.189, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id c2rw26zS-IJx for <oauth@ietfa.amsl.com>; Fri, 25 Apr 2014 07:22:54 -0700 (PDT)
Received: from na3sys009aog132.obsmtp.com (na3sys009aog132.obsmtp.com [74.125.149.250]) by ietfa.amsl.com (Postfix) with ESMTP id 8256E1A04B6 for <oauth@ietf.org>; Fri, 25 Apr 2014 07:22:52 -0700 (PDT)
Received: from mail-ig0-f174.google.com ([209.85.213.174]) (using TLSv1) by na3sys009aob132.postini.com ([74.125.148.12]) with SMTP ID DSNKU1pvsPwsJTn7eq2d7kHNhel8qUniKs0N@postini.com; Fri, 25 Apr 2014 07:22:46 PDT
Received: by mail-ig0-f174.google.com with SMTP id h18so2243029igc.1 for <oauth@ietf.org>; Fri, 25 Apr 2014 07:22:30 -0700 (PDT)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc:content-type; bh=XKGUIgUjZQz849aUZMZUeSBsNSrWT+Jl12vLTNoyzI8=; b=cRioqAiJgh1nk84qrKHwcGlTy6fPWq9e/uEeSeZJfx0ILSz6FsPdTculSWo3EOLuT2 S+0r0pIwgE7bnaRzB2fPd5hz9V25piVslDxJANm7T+5B7L0u+dHGSfOnZ+G1sD7v89ld 4g9zjgtgfASCPtwGJHqzrte/F8pBHcoSCrGzri98ov4ArLCkilDzuHV1lDIQiUfch3Q3 V+d1hmLWNrxY11JGfmF9cQvKX7L/RVzI+xTgAq90ERPWod36/Xs4K+ppd5aTE099NZeN 3LQSwjncoovSTElgyRqiwuMEepjB3iz4Dsp2yn07CQnREo507dPYD9tJFEg7ca5s6o+y 2glw==
X-Gm-Message-State: ALoCoQlO1AAtq5XLzELv+7PUBUJWtJkcaavIB5fh1Fs5OPuiPO1oWOyBMCk9XKqxnTZEHAUQGIB4pAcTlxzwdnO7TgOnIgCHSOWcTvT6Bjke4lstkTA2QzkXW29aqwOtfzK0C9wZ6qua
X-Received: by 10.50.153.49 with SMTP id vd17mr5392373igb.40.1398435750758; Fri, 25 Apr 2014 07:22:30 -0700 (PDT)
X-Received: by 10.50.153.49 with SMTP id vd17mr5392349igb.40.1398435750608; Fri, 25 Apr 2014 07:22:30 -0700 (PDT)
MIME-Version: 1.0
Received: by 10.64.240.201 with HTTP; Fri, 25 Apr 2014 07:22:00 -0700 (PDT)
In-Reply-To: <535A5819.2030805@gmx.net>
References: <535A3AF4.4060506@gmx.net> <5E2E0F9B-AB61-43AA-B182-E776C97C83FE@adobe.com> <535A5819.2030805@gmx.net>
From: Brian Campbell <bcampbell@pingidentity.com>
Date: Fri, 25 Apr 2014 08:22:00 -0600
Message-ID: <CA+k3eCTRwPB-BNAoSkzsPCYjP-tuynLLxxHMJcvA4kDFj3aRLQ@mail.gmail.com>
To: Hannes Tschofenig <hannes.tschofenig@gmx.net>
Content-Type: multipart/alternative; boundary=089e014954be28192e04f7deb27c
Archived-At: http://mailarchive.ietf.org/arch/msg/oauth/Fatkzz5KWf6ylOaeKllDsNjFYmo
Cc: "oauth@ietf.org" <oauth@ietf.org>
Subject: Re: [OAUTH-WG] draft-ietf-oauth-json-web-token-19 - Examples
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/oauth/>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Apr 2014 14:22:57 -0000

Note that the draft is showing an *octet sequence* with each individual
octet being shown as decimal value. It doesn't state anything about using
octal, the base-8 number system. Those octets also show unambiguously what
is being base64url encoded (including the line endings via "13, 10") - no
matter how the unencoded headers or bodies are shown in the draft, there's
going to be potential confusion about what white space and line breaks is
or is not to be included in the encoding and serialization so giving the
octet sequence alleviates that. It's maybe also worth noting that the JOSE
suite of specs all use the same notation and text in their examples.

If we were to add another example as was suggested, it should probably use
a shared secret with a little more entropy as '12345' isn't strictly
compliant with the normative requirements in JWA for HS256.
http://tools.ietf.org/html/draft-ietf-jose-json-web-algorithms-25#section-3.2states
that a 'key of the same size as the hash output (for instance, 256
bits for "HS256") or larger MUST be used.'




On Fri, Apr 25, 2014 at 6:42 AM, Hannes Tschofenig <
hannes.tschofenig@gmx.net> wrote:

> Hi Antonio
>
> good to see that others have run into the same issue before.
>
> I wonder why the carriage return and the line feed had been inserted.
>
> We either need some text to explain this in the example or to use an
> example that does not use carriage returns or line feeds.
>
> Ciao
> Hannes
>
> On 04/25/2014 01:48 PM, Antonio Sanso wrote:
> > hi Hannes.
> >
> >
> > On Apr 25, 2014, at 12:37 PM, Hannes Tschofenig <
> hannes.tschofenig@gmx.net> wrote:
> >
> >> Hi all,
> >>
> >> As a document shepherd I have to verify the entire document and this
> >> includes the examples as well.
> >>
> >> Section 3.1:
> >>
> >> You write:
> >>
> >> "
> >>   The following octet sequence is the UTF-8 representation of the JWT
> >>   Header/JWS Header above:
> >>
> >>   [123, 34, 116, 121, 112, 34, 58, 34, 74, 87, 84, 34, 44, 13, 10, 32,
> >>   34, 97, 108, 103, 34, 58, 34, 72, 83, 50, 53, 54, 34, 125]
> >> "
> >>
> >> The values IMHO are represented in Decimal code point rather than Octal
> >> UTF-8 bytes, as stated above.
> >> See the following online tool to see the difference:
> >> http://www.ltg.ed.ac.uk/~richard/utf-8.cgi?input=%22&mode=char
> >>
> >> Note that you could also show a hex encoding instead (e.g., via
> >> http://ostermiller.org/calc/encode.html). Hixie's decoder would then
> >> produce the correct decoding. Here is the link to his software:
> >> http://software.hixie.ch/utilities/cgi/unicode-decoder/utf8-decoder
> >> (Note that this program seems to have flaws for most other options.)
> >>
> >> When do a Base64URL encoding of
> >>
> >> {"typ":"JWT","alg":"HS256"}
> >>
> >> then I get
> >>
> >> eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9
> >>
> >> but your spec says:
> >>
> >> eyJ0eXAiOiJKV1QiLA0KICJhbGciOiJIUzI1NiJ9
> >>
> >> Same with {"iss":"joe","exp":1300819380,"http://example.com/is_root
> ":true}.
> >>
> >> My result:
> >>
> eyJpc3MiOiJqb2UiLCJleHAiOjEzMDA4MTkzODAsImh0dHA6Ly9leGFtcGxlLmNvbS9pc19yb290Ijp0cnVlfQ
> >>
> >> Your result:
> >>
> eyJpc3MiOiJqb2UiLA0KICJleHAiOjEzMDA4MTkzODAsDQogImh0dHA6Ly9leGFtcGxlLmNvbS9pc19yb290Ijp0cnVlfQ
> >
> > see http://www.ietf.org/mail-archive/web/oauth/current/msg11599.html
> >
> > regards
> >
> > antonio
> >
> >>
> >> Note: I am using this online tool for Base64URL encoding:
> >> http://kjur.github.io/jsjws/tool_b64uenc.html.
> >> Interestingly, when I dump the data into http://jwt.io/ then I get a
> >> correct decoding. It might well be that the kjur.github.io has a flaw.
> >>
> >> Just wanted to check what tool you have used to create these encodings.
> >>
> >>
> >> Section 6.1:
> >>
> >> The example in Section 6.1 is the same as in 3.1. Maybe it would be
> >> useful to show something different here.
> >>
> >> The example in Appendix A.1 is more sophisticated since it demonstrates
> >> encryption. To verify it I would need to have a library that supports
> >> JWE and RSAES-PKCS1-V1_5 and AES_128_CBC_HMAC_SHA_256. Which library
> >> have you been using?
> >>
> >> I was wondering whether it would make sense to add two other examples,
> >> namely for integrity protection. One example showing an HMAC-based keyed
> >> message digest and another one using a digital signature.
> >>
> >> Here is a simple example to add that almost all JWT libraries seem to be
> >> able to create and verify:
> >>
> >> Header:
> >> {"alg":"HS256","typ":"JWT"}
> >>
> >> I use the HS256 algorithm with a shared secret '12345'.
> >>
> >> Body:
> >>
> >> {"iss":"https://as.example.com","sub":"mailto:john@example.com
> ","nbf":1398420753,"exp":1398424353,"iat":1398420753}
> >>
> >> jwt.encode({"iss":"https://as.example.com","sub":"mailto:
> john@example.com
> ","nbf":1398420753,"exp":1398424353,"iat":1398420753},"12345",
> >> "HS256")
> >>
> >> I used http://www.onlineconversion.com/unix_time.htm to create the
> >> date/time values:
> >> "nbf":1398420753 --> Fri, 25 Apr 2014 10:12:33 GMT
> >> "exp":1398424353 --> Fri, 25 Apr 2014 11:12:33 GMT
> >> "iat":1398420753 --> Fri, 25 Apr 2014 10:12:33 GMT
> >>
> >> Here is the output created with https://github.com/progrium/pyjwt/ and
> >> verified with http://jwt.io/:
> >>
> eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJodHRwczovL2FzLmV4YW1wbGUuY29tIiwiaWF0IjoxMzk4NDIwNzUzLCJzdWIiOiJtYWlsdG86am9obkBleGFtcGxlLmNvbSIsImV4cCI6MTM5ODQyNDM1MywibmJmIjoxMzk4NDIwNzUzfQ.0gfRUIley70bMP7hN6sMWkHwHezdrv2E1LAVcNdTsq4
> >>
> >> Ciao
> >> Hannes
> >>
> >>
> >> _______________________________________________
> >> OAuth mailing list
> >> OAuth@ietf.org
> >> https://www.ietf.org/mailman/listinfo/oauth
> >
>
>
> _______________________________________________
> OAuth mailing list
> OAuth@ietf.org
> https://www.ietf.org/mailman/listinfo/oauth
>
>