IETF Logo Mail Archive

Re: [OAUTH-WG] AD review of draft-ietf-oauth-jwsreq

"Nat Sakimura" <n-sakimura@nri.co.jp> Wed, 04 January 2017 06:41 UTC

Return-Path: <n-sakimura@nri.co.jp>
X-Original-To: oauth@ietfa.amsl.com
Delivered-To: oauth@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EDB7F129483 for <oauth@ietfa.amsl.com>; Tue, 3 Jan 2017 22:41:44 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.9
X-Spam-Level:
X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WqGEnrBtjCqn for <oauth@ietfa.amsl.com>; Tue, 3 Jan 2017 22:41:43 -0800 (PST)
Received: from nrifs01.index.or.jp (nrigw01.index.or.jp [133.250.250.1]) by ietfa.amsl.com (Postfix) with ESMTP id B61A9126D73 for <oauth@ietf.org>; Tue, 3 Jan 2017 22:41:41 -0800 (PST)
Received: from nrimmfm052.index.or.jp (unknown [172.19.246.144]) by nrifs01.index.or.jp (Postfix) with ESMTP id 34F3B77ED8; Wed, 4 Jan 2017 15:41:41 +0900 (JST)
Received: from index.or.jp (unknown [172.19.246.151]) by nrimmfm052.index.or.jp (Postfix) with ESMTP id 0356D4E0046; Wed, 4 Jan 2017 15:41:41 +0900 (JST)
Received: from nriea05.index.or.jp (localhost.localdomain [127.0.0.1]) by pps.mf051 (8.15.0.59/8.15.0.59) with SMTP id v046feoh005501; Wed, 4 Jan 2017 15:41:40 +0900
Received: from nrims00b.nri.co.jp ([192.50.135.12]) by nriea05.index.or.jp with ESMTP id v046fexr005498; Wed, 04 Jan 2017 15:41:40 +0900
Received: from nrims00b.nri.co.jp (localhost.localdomain [127.0.0.1]) by nrims00b.nri.co.jp (Switch-3.3.4/Switch-3.3.4) with ESMTP id v046feFV002538; Wed, 4 Jan 2017 15:41:40 +0900
Received: (from mailnull@localhost) by nrims00b.nri.co.jp (Switch-3.3.4/Switch-3.3.0/Submit) id v046fet5002537; Wed, 4 Jan 2017 15:41:40 +0900
X-Authentication-Warning: nrims00b.nri.co.jp: mailnull set sender to n-sakimura@nri.co.jp using -f
Received: from nrizmf12.index.or.jp ([172.100.25.21]) by nrims00b.nri.co.jp (Switch-3.3.4/Switch-3.3.4) with ESMTP id v046feAx002529; Wed, 4 Jan 2017 15:41:40 +0900
From: Nat Sakimura <n-sakimura@nri.co.jp>
To: 'John Bradley' <ve7jtb@ve7jtb.com>, 'Nat Sakimura' <sakimura@gmail.com>
References: <CAHbuEH4Vxdda4yUH932GEZjEiLi1KdYU9_1MLoLAn_AZA=41Yw@mail.gmail.com> <CABzCy2BoAYtpsbU6Pi3rimVOdQcsop=P5k3-+9BLoNXmi8Pc9w@mail.gmail.com> <aad3663c-aed1-61d9-5356-58c1e6f94bd2@free.fr> <CABzCy2DzYxU-EMiA4QCpggawMCMPsw+5pyFsza_gnuhn3hGfqQ@mail.gmail.com> <9819C8B0-E1DB-47E0-9639-F85CACA8DB23@ve7jtb.com>
In-Reply-To: <9819C8B0-E1DB-47E0-9639-F85CACA8DB23@ve7jtb.com>
Date: Wed, 04 Jan 2017 15:41:48 +0900
Message-ID: <026701d26655$a00cea60$e026bf20$@nri.co.jp>
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="----=_NextPart_000_0268_01D266A1.0FF68E30"
X-Mailer: Microsoft Outlook 15.0
X-MailAdviser: 20141126
thread-index: AQJXUKfdpVtfeHi9xJkdDON5i8N4cwGEHProAhobz/oCfSMdqwOkKcpBn9ANOGA=
Content-Language: ja
Archived-At: <https://mailarchive.ietf.org/arch/msg/oauth/X79xigSZkxWa-I3yGCCcqEE2AII>
Cc: oauth@ietf.org
Subject: Re: [OAUTH-WG] AD review of draft-ietf-oauth-jwsreq
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/oauth/>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 04 Jan 2017 06:41:45 -0000

Yes, indeed. And when I wrote "acceptable", I meant "in principle", not
verbatim ;-)

 

Nat

 

--

PLEASE READ :This e-mail is confidential and intended for the

named recipient only. If you are not an intended recipient,

please notify the sender  and delete this e-mail.

 

From: OAuth [mailto:oauth-bounces@ietf.org] On Behalf Of John Bradley
Sent: Wednesday, January 4, 2017 4:45 AM
To: Nat Sakimura <sakimura@gmail.com>
Cc: oauth@ietf.org
Subject: Re: [OAUTH-WG] AD review of draft-ietf-oauth-jwsreq

 

Snip

On Jan 3, 2017, at 2:36 PM, Nat Sakimura <sakimura@gmail.com
<mailto:sakimura@gmail.com> > wrote:

 

 

 

2) On page 9 the text states:

The authorization request object MUST be either

   (a)  JWS signed; or

   (b)  JWE encrypted; or

   (c)  JWS signed and JWE encrypted.

 

This should be replaced by:

The authorization request object MUST be either

   (a)  JWS signed; 

   (b)  JWE encrypted (when secret keys are being used); or

   (c)  JWS signed and JWE encrypted.

 

That's acceptable. (Thanks for amending your proposal after several private
exchanges.)  

 

 

 

Secret is not a clear term to use.  It should be JWE encrypted (when
symmetric keys are bing used)  

The private part of a RSA keypair is also secret.

 

John B.

v2.23.0 | Report a Bug | By Email