Re: [POSH] Fwd: I-D Action: draft-miller-posh-01.txt

[Tobias Markmann <[e-mail]>]

Hi,

Matt Miller (mamille2) wrote:

FYI, the latest draft incorporates just about all of the feedback we
received as a result of the BoF, minus ASCII art; we'll see about that
for the next version!


- m&m

Matt Miller < [e-mail] >
Cisco Systems, Inc.


here some feedback based on an initial read of the changes.

Section 4.1


   Additionally, each JWK object MUST possess at least one of the
   following:

   o  The "x5t" field set to the certificate thumbprint, as per <a href="http://tools.ietf.org/html/draft-miller-posh-01#section-3.6">section: ]
      <a href="http://tools.ietf.org/html/draft-miller-posh-01#section-3.6">3.6: ] of [<a href="http://tools.ietf.org/html/draft-miller-posh-01#ref-JOSE-JWK">JOSE-JWK: ]].


   o  The "x5c" field set to the certificate chain, as per section 3.7
      of [<a href="http://tools.ietf.org/html/draft-miller-posh-01#ref-JOSE-JWK">JOSE-JWK: ]].

<div class="message-gap">
	<p style="margin: 0px; padding: 0px; ">
		 

<div class="message-signature" id="signature_1378760946803-1670277853" name="signature_1378760946803-1670277853">
	I suggest making x5t, the thumbprint/fingerprint, a MUST to reduce the mimimum possible code paths to implement this draft, considering not all TLS API provide access to the public key's modulus and exponent. In addition, verification using the thumbprint is independent of the type of key (RSA, ECC, …) that the certficate uses, which further eases implementation and straightens the codepath. I'd still allow (MAY) inclusion of x5c, for debugging purposes though.
<div class="message-signature" name="signature_1378760946803-1670277853">
	 
<div class="message-signature" name="signature_1378760946803-1670277853">
	Cheers,
<div class="message-signature" name="signature_1378760946803-1670277853">
	Tobi