Re: [secdir] [jose] JWK member names, was: SECDIR review of draft-ietf-jose-json-web-key-31

Tim Bray <tbray@textuality.com> Wed, 17 September 2014 16:43 UTC

Return-Path: <tbray@textuality.com>
X-Original-To: secdir@ietfa.amsl.com
Delivered-To: secdir@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CFD571A04C5 for <secdir@ietfa.amsl.com>; Wed, 17 Sep 2014 09:43:11 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.977
X-Spam-Level:
X-Spam-Status: No, score=-1.977 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7] autolearn=unavailable
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id idX0Q2ovvxbT for <secdir@ietfa.amsl.com>; Wed, 17 Sep 2014 09:43:09 -0700 (PDT)
Received: from mail-vc0-f171.google.com (mail-vc0-f171.google.com [209.85.220.171]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C60F21A067B for <secdir@ietf.org>; Wed, 17 Sep 2014 09:43:09 -0700 (PDT)
Received: by mail-vc0-f171.google.com with SMTP id ik5so655742vcb.2 for <secdir@ietf.org>; Wed, 17 Sep 2014 09:43:08 -0700 (PDT)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc:content-type; bh=0GuI6W3zQtDdNTe1wz5qyF/7jMCuzLDLiodMNSZJPOw=; b=NpIMe5Kh97ChhfSuXNBYUwy8L/33nSmbQSsdzUrtfnAGG1ZKyroH74lJ8cxvj4FuJ+ QSPpiaCzmE9CuyRY/7V7+atWwPbk4/rKaMshlItGRvRYJCMmZWjgbPzmhNdw/zuCH6zs 0f72FATMDS2JMWaiXXpkIjJeKdUmZB5YjGYjZhzWTUwKpdk3MpWrWtIlBxF1cgZ7zlcK qxztfQqsObZXD4mWFdz4t4Z4ZY8Tcb86nLyAH9MrFKekrbjp0FTVlyfkBfpyRxWf7UFc Smcj/PPnWpkCPz52i8iUb/lTqVwHRI9hDgnhuNGAJF9Ttolcbr8Lj1laidDuZhJ+ULXV kqVw==
X-Gm-Message-State: ALoCoQnw7fcFBkHIZEc8lwSaoFlYAiWjDhehaIX+lqxrzMS1Q3uWNBM5vbMsDFtFguKf0OTLs9Ij
X-Received: by 10.52.183.136 with SMTP id em8mr1424791vdc.76.1410972188811; Wed, 17 Sep 2014 09:43:08 -0700 (PDT)
MIME-Version: 1.0
Received: by 10.220.214.4 with HTTP; Wed, 17 Sep 2014 09:42:48 -0700 (PDT)
X-Originating-IP: [24.84.235.32]
In-Reply-To: <54199E11.1000809@bbn.com>
References: <CAHbuEH4Ccn2Z=8kEECzvgjmtshwsFoa-EH_NpkJPos7zirGeaQ@mail.gmail.com> <4E1F6AAD24975D4BA5B16804296739439AEC00DB@TK5EX14MBXC292.redmond.corp.microsoft.com> <5416FE10.3060608@bbn.com> <CAHBU6iu3GfsLCAint3z7risZUnVW4EK0WrGVW6Dv=gvppiHSxQ@mail.gmail.com> <4E1F6AAD24975D4BA5B16804296739439AECCCDD@TK5EX14MBXC292.redmond.corp.microsoft.com> <54173546.5000400@bbn.com> <CAHBU6ivb3BeEufcnJB+eSk8wgETMx+qzH3miE6Z1jtrQkXNR3w@mail.gmail.com> <4E1F6AAD24975D4BA5B16804296739439AECE40B@TK5EX14MBXC292.redmond.corp.microsoft.com> <54184EBA.3010109@bbn.com> <4E1F6AAD24975D4BA5B16804296739439AED1727@TK5EX14MBXC292.redmond.corp.microsoft.com> <5418987E.1060307@bbn.com> <CFD36394-E707-4D51-9689-DD8B1FD320D5@ve7jtb.com> <54199E11.1000809@bbn.com>
From: Tim Bray <tbray@textuality.com>
Date: Wed, 17 Sep 2014 09:42:48 -0700
Message-ID: <CAHBU6ivJ+mQZetWDDkRjP1nB+XOCLyXatq4k9bv4y7onAgu=ug@mail.gmail.com>
To: Stephen Kent <kent@bbn.com>
Content-Type: multipart/alternative; boundary=bcaec5489e431a37b40503459099
Archived-At: http://mailarchive.ietf.org/arch/msg/secdir/OFovKeeM8j3XIj0JbpPjRYnmZ-M
Cc: "jose-chairs@tools.ietf.org" <jose-chairs@tools.ietf.org>, "secdir@ietf.org" <secdir@ietf.org>, "draft-ietf-jose-json-web-key.all@tools.ietf.org" <draft-ietf-jose-json-web-key.all@tools.ietf.org>, Kathleen Moriarty <kathleen.moriarty.ietf@gmail.com>, Michael Jones <Michael.Jones@microsoft.com>, "jose@ietf.org" <jose@ietf.org>, John Bradley <ve7jtb@ve7jtb.com>
Subject: Re: [secdir] [jose] JWK member names, was: SECDIR review of draft-ietf-jose-json-web-key-31
X-BeenThere: secdir@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Security Area Directorate <secdir.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/secdir>, <mailto:secdir-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/secdir/>
List-Post: <mailto:secdir@ietf.org>
List-Help: <mailto:secdir-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/secdir>, <mailto:secdir-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 17 Sep 2014 16:43:12 -0000

The chance  of the JOSE working group moving the vast world of deployed
JSON infrastructure round to 0.00.   Thus putting a MUST reject in here
would essentially say you can’t use well-debugged production software, and
would be a really bad idea.

On the other hand, if JOSE specified that producers’ messages MUST conform
to I-JSON, and a couple other WGs climbed on that bandwagon, and the word
started to get around, I wouldn’t be surprised if a few of the popular JSON
implementations added an I-JSON mode.  That would be a good thing and
lessen the attack surface of all JSON-based protocols (which these days, is
a whole lot of them).



On Wed, Sep 17, 2014 at 7:43 AM, Stephen Kent <kent@bbn.com> wrote:

> OK, now I have a clear answer to the question I posed earlier, i.e., this
> is a JSON parser problem, not specific to the JOSE-defined formats.
>
> I still believe it makes sense for the RFC(s) to mandate rejection of
> duplicates,
> as a way to "encourage" transition to better parsers, as others have
> noted. And
> I rely on Tero's judgement that the required changes are not onerous.
>
> Steve
>



-- 
- Tim Bray (If you’d like to send me a private message, see
https://keybase.io/timbray)