From: "Adam W. Montville" <adam.w.montville@gmail.com>
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
Message-Id: <A1BD2DB0-A7D9-4635-8A3B-074303AF2E55@gmail.com>
Date: Mon, 8 Jun 2015 10:46:29 -0500
To: The IESG <iesg@ietf.org>, secdir@ietf.org,
 draft-ietf-jose-jwk-thumbprint.all@ietf.org
Mime-Version: 1.0 (Mac OS X Mail 8.2 \(2098\))
Archived-At: <http://mailarchive.ietf.org/arch/msg/secdir/I5QhkbwEWPcouO1yXjOR0tKrsGQ>
Subject: [secdir] sector review of draft-ietf-jose-jwk-thumbprint-05
Precedence: list

Hi,

I have reviewed this document as part of the security directorate's =
ongoing effort to review all IETF documents being processed by the IESG. =
These comments were written primarily for the benefit of the security =
area directors. Document editors and WG chairs should treat these =
comments just like any other last call comments.

I believe the document is ready with (potential) issues.  The =E2=80=9Cwit=
h issues=E2=80=9D might be due to ignorance on my part.  The draft does =
a very good job of explaining the canonical form of a JSON Web Key that =
can be used for establishing a thumbprint under varying circumstances, =
complete with what I found to be helpful examples.

The primary issue I have is that it=E2=80=99s unclear how relying =
parties are going to know which hash algorithm has been used.  The =
examples use SHA-256, but I=E2=80=99m not seeing where SHA-256 might be =
specified as a MUST or even a SHOULD.  Moreover, the example output =
ultimately shows only the Base-64 encoding of the resulting hash, which =
says nothing about the algorithm used to identify a key.

Additionally, in Section 4, =E2=80=9CJSON and Unicode Considerations=E2=80=
=9D some =E2=80=9Cshould=E2=80=9Ds are used, but I=E2=80=99m not reading =
them as SHOULDs.  Should they be SHOULDs?  For example, the start of the =
third paragraph in that section: =E2=80=9Cif new JWK members are defined =
that use non-ASCII member names, their definitions should specify the =
exact Unicode code point sequences used to represent them.=E2=80=9D  =
It=E2=80=99s not clear to me whether this is a strong statement or just =
a recommendation - it seems that this draft could help the future by =
making stronger statements to encourage future interoperability.

Kind regards,

Adam=