Re: [saag] [CFRG] OCB does not have an OID specified, that is a general problem

[Phillip Hallam-Baker <[e-mail]>]

On Fri, Jun 11, 2021 at 6:00 AM Neil Madden <[e-mail]> wrote:

> On 8 Jun 2021, at 17:36, Phillip Hallam-Baker <[e-mail]>
> wrote:
>
>
>
> Not at all. My point is that the purpose of a registry is limited to
> assigning a signifier to one or more signified. It is not for IANA to
> specify that RSA is required or not, that is a WG decision.
>
>
> And yet that is exactly what is recorded in the IANA JOSE registry. I
> appreciate that you’d like things to be different, but that’s not the
> reality today. A WG established the IANA registry and set up the procedures
> by which alterations to it are made, as described in RFC 7518 that
> established the registry (p34):
>

Yes, like I said. It was a mistake. There is no need to compound it.

> And merely assigning a code point does not change the recommendations for
> implementing algorithms in a 'JOSE Library'.
>
> It absolutely does in this case.
>

Only because there is a column giving the recommendation status. My point
is that is a mistake.

By your own admission the Mesh is doing something entirely non-standard
> with JOSE anyway, so you are also free to also adopt OCB as a non-standard
> algorithm.
>

It will become the standard if people use it. Which is precisely the point:
Code point registrations are properties of algorithms, not one particular
protocol that might use them. There should never have been a JOSE algorithm
registry in the first place, it should have been a registry of algorithms
that JOSE was merely the first consumer of.

I remember when the IANA Content Type Registry was the MIME Type. If MIME
had made recommendations for supported types, should those have been
binding on the Web?