Re: [POSH] I-D Action: draft-miller-posh-01.txt

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

WFM!

On 9/10/13 3:42 PM, Matt Miller (mamille2) wrote:
> Thanks for the feedback!  Requiring just the "x5t" makes sense, and
> we can incorporate that change in the next revision.
> 
> 
> - m&m
> 
> Matt Miller < mamille2@cisco.com > Cisco Systems, Inc.
> 
> On Sep 9, 2013, at 3:54 PM, Tobias Markmann
> <tmarkmann@googlemail.com> wrote:
> 
>> 
>> Hi,
>> 
>> Matt Miller (mamille2) wrote:
>> 
>> FYI, the latest draft incorporates just about all of the feedback
>> we received as a result of the BoF, minus ASCII art; we'll see
>> about that for the next version!
>> 
>> 
>> - m&m
>> 
>> Matt Miller < mamille2@cisco.com > Cisco Systems, Inc.
>> 
>> 
>> here some feedback based on an initial read of the changes.
>> 
>> Section 4.1
>> 
>> 
>> Additionally, each JWK object MUST possess at least one of the 
>> following:
>> 
>> o  The "x5t" field set to the certificate thumbprint, as per <a
>> href="http://tools.ietf.org/html/draft-miller-posh-01#section-3.6">section:
>> ] <a
>> href="http://tools.ietf.org/html/draft-miller-posh-01#section-3.6">3.6:
>> ] of [<a
>> href="http://tools.ietf.org/html/draft-miller-posh-01#ref-JOSE-JWK">JOSE-JWK:
>> ]].
>> 
>> 
>> o  The "x5c" field set to the certificate chain, as per section
>> 3.7 of [<a
>> href="http://tools.ietf.org/html/draft-miller-posh-01#ref-JOSE-JWK">JOSE-JWK:
>> ]].
>> 
>> <div class="message-gap"> <p style="margin: 0px; padding: 0px;
>> "> 
>> 
>> <div class="message-signature"
>> id="signature_1378760946803-1670277853"
>> name="signature_1378760946803-1670277853"> I suggest making x5t,
>> the thumbprint/fingerprint, a MUST to reduce the mimimum possible
>> code paths to implement this draft, considering not all TLS API
>> provide access to the public key's modulus and exponent. In
>> addition, verification using the thumbprint is independent of the
>> type of key (RSA, ECC, ?) that the certficate uses, which further
>> eases implementation and straightens the codepath. I'd still
>> allow (MAY) inclusion of x5c, for debugging purposes though. <div
>> class="message-signature"
>> name="signature_1378760946803-1670277853">  <div
>> class="message-signature"
>> name="signature_1378760946803-1670277853"> Cheers, <div
>> class="message-signature"
>> name="signature_1378760946803-1670277853"> Tobi
> 
> 
> 
> _______________________________________________ posh mailing list 
> posh@ietf.org https://www.ietf.org/mailman/listinfo/posh
> 

- -- 
Peter Saint-Andre
https://stpeter.im/

-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.19 (Darwin)
Comment: GPGTools - http://gpgtools.org
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/

iQIcBAEBAgAGBQJSL5vhAAoJEOoGpJErxa2poWIP/15hKeMaMbnnBL7B5WNrlFaA
nb1q5c47R/mG3CP5U+tde383fIDAFrOZ7WWFhB4YAZIpSiSlQY7CTuMlA5Ezv8Nb
UooOvDOZ8DzPViRFX6NPuhqjnr3/uJ3O2pSZI32ftako4dTnXXaptFNsHpEl9x9s
WiG6K/ESDf1qs8MxPpqL+lb5jrCrmydVhOU2ZnjAgwbmIoJD1mkVeS3QwkN6Bhjo
pvLG148Ux6Wf+17jzMjBw5dMgIpn8EHx9bVVvrywcB6rYY3/hQrJT29DVpOQ3VLU
RA1FXy5R53LKpTuT/DStUywgNfjyWh6rKGYURkkIRxWS3Nwuz0BV5uPJasBq2GXK
HzGacqeAobH9kD+MwMIL7d3TmqvxSR6yyJOrTCtYP5dhYkF8ZAkaK2plbZ7gWLaT
qQl2Y1x2S1n2a3QnBI4ziJ5U3zAHrz6BkVDzVMM6xEuDdsTppWLdx6YZA2B/nD7h
+fR9QsPZuKfgt8igf6GJJ6DbZ1zLoMrzGzbUdFVhCtJToaGYEQBj+ytAs71btyTQ
9k6efC1TNFvzwsruBRnPYIzIwYb4NVP8Il2BmJsrz27Ci12G/TGwfqF9IPZ6Z6Yn
CkG8orS3AVwwvrqfxo1/1mbhU7UTMBIABIa69KjvfbmnauRIozH4f+rFaPurPZGt
JkSASPz6dlfmCOnbduBK
=tF3x
-----END PGP SIGNATURE-----