Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 406E61ABB1A; Thu, 11 Jun 2015 14:25:26 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.902 X-Spam-Level: X-Spam-Status: No, score=-1.902 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CeXQqY84zBRX; Thu, 11 Jun 2015 14:25:24 -0700 (PDT) Received: from na01-by2-obe.outbound.protection.outlook.com (mail-by2on0130.outbound.protection.outlook.com [207.46.100.130]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4C2F21A8869; Thu, 11 Jun 2015 14:25:24 -0700 (PDT) Received: from BY2PR03MB444.namprd03.prod.outlook.com (10.141.141.154) by BY2PR03MB508.namprd03.prod.outlook.com (10.141.143.27) with Microsoft SMTP Server (TLS) id 15.1.184.17; Thu, 11 Jun 2015 21:25:24 +0000 Received: from BY2PR03MB442.namprd03.prod.outlook.com (10.141.141.145) by BY2PR03MB444.namprd03.prod.outlook.com (10.141.141.154) with Microsoft SMTP Server (TLS) id 15.1.195.6; Thu, 11 Jun 2015 21:25:22 +0000 Received: from BY2PR03MB442.namprd03.prod.outlook.com ([10.141.141.145]) by BY2PR03MB442.namprd03.prod.outlook.com ([10.141.141.145]) with mapi id 15.01.0195.005; Thu, 11 Jun 2015 21:25:22 +0000 From: Mike Jones To: "Adam W. Montville" , The IESG , "secdir@ietf.org" , "draft-ietf-jose-jwk-thumbprint.all@ietf.org" Thread-Topic: sector review of draft-ietf-jose-jwk-thumbprint-05 Thread-Index: AQHQogJgaphBjlti2Uu758g0GQEF3p2nztYw Date: Thu, 11 Jun 2015 21:25:22 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: gmail.com; dkim=none (message not signed) header.d=none; x-originating-ip: [2001:4898:80e0:ee43::6] x-microsoft-exchange-diagnostics: 1; BY2PR03MB444; 5:d9Ho590BsYK5Qe32G3meUj+fWL+1noc4EBJZBPT858zyApvFD7nDFmeF6NZTxvxXqKswewpdaedCo04mhB3UHu2qd+V/tu0Sbsfnv7kkWdUXZikTtv+w5Nw/wrdzWcAFo+tY2Z+halFvL+DK5E95ow==; 24:D1/cJGrZQrW8SuDG5bW+hAZy+X3+gjHGJ2bJeggWRKa/Xqfv+uyIazK+Vis4+so2M5YK1lVDJ54CFzYsM7D8X77S3YmBJVrZ183f/qL95xU=; 20:8ddfMdLv9wvj4/89snG7e+9GKR8vUDXJHV41D6B8MKNTlaWjjtukdhNyxCmfrOtBKr6z4PfkH7b27ScQHZ8Gwg== x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:; SRVR:BY2PR03MB444; UriScan:; BCL:0; PCL:0; RULEID:; SRVR:BY2PR03MB508; x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:; x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(601004)(2401001)(5005006)(3002001); SRVR:BY2PR03MB444; BCL:0; PCL:0; RULEID:; SRVR:BY2PR03MB444; x-forefront-prvs: 0604AFA86B x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(6009001)(377454003)(43784003)(71364002)(51704005)(5003600100002)(2900100001)(92566002)(2950100001)(77096005)(62966003)(77156002)(5001960100002)(2201001)(46102003)(230783001)(86612001)(99286002)(86362001)(2501003)(40100003)(15975445007)(2656002)(19580405001)(19580395003)(54356999)(5002640100001)(122556002)(76176999)(76576001)(33656002)(50986999)(106116001)(5001770100001)(102836002)(74316001)(87936001)(189998001)(3826002); DIR:OUT; SFP:1102; SCL:1; SRVR:BY2PR03MB444; H:BY2PR03MB442.namprd03.prod.outlook.com; FPR:; SPF:None; MLV:sfv; LANG:en; Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-MS-Exchange-CrossTenant-originalarrivaltime: 11 Jun 2015 21:25:22.6629 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: BY2PR03MB444 X-Microsoft-Exchange-Diagnostics: 1; BY2PR03MB508; 2:V6cT3Atht8izR7pLuSuqcxNM1z/6TPHtf2fiQOMxrPHAKRFBkroX5z7500llu9st; 2:xKZVWc/13nrMdOS41H8VaZ64tRqQgWjuX3GEdKban1eOpx6+1TIL3ktLlhr015zPSfAKiUBwKeQSVDh5K3nj3eXxQpzn8IW5PxGxj7mjcp88mjK89kWF5IeS9oD35J5fV5a/KMF7ngMnHGPb2D5doQ==; 9:/lniCRXPfCAMtc/uTi/zhwoD0hCAOsW4vFG2XObCligKru5n//UoEp3Hz7vtV/QmkWfE34mS4DogD3EB7aT/aU44KgisG8jU2UEHXYcQUqSsozoNtbp26MJA46NAHfFUkzL9hEQAr+yOo2drqVz9mg== X-OriginatorOrg: microsoft.com Archived-At: Cc: "jose@ietf.org" Subject: Re: [secdir] sector review of draft-ietf-jose-jwk-thumbprint-05 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 11 Jun 2015 21:25:26 -0000 SGkgQWRhbSwNCg0KVGhhbmtzIGZvciB0aGUgc2VjZGlyIHJldmlldy4NCg0KPiBGcm9tOiBBZGFt IFcuIE1vbnR2aWxsZSBbbWFpbHRvOmFkYW0udy5tb250dmlsbGVAZ21haWwuY29tXQ0KPiBTZW50 OiBNb25kYXksIEp1bmUgMDgsIDIwMTUgODo0NiBBTQ0KPiBUbzogVGhlIElFU0c7IHNlY2RpckBp ZXRmLm9yZzsgZHJhZnQtaWV0Zi1qb3NlLWp3ay10aHVtYnByaW50LmFsbEBpZXRmLm9yZw0KPiBT dWJqZWN0OiBzZWN0b3IgcmV2aWV3IG9mIGRyYWZ0LWlldGYtam9zZS1qd2stdGh1bWJwcmludC0w NQ0KDQo+IEhpLA0KDQo+IEkgaGF2ZSByZXZpZXdlZCB0aGlzIGRvY3VtZW50IGFzIHBhcnQgb2Yg dGhlIHNlY3VyaXR5IGRpcmVjdG9yYXRlJ3Mgb25nb2luZyBlZmZvcnQgdG8gcmV2aWV3IGFsbCBJ RVRGIGRvY3VtZW50cyBiZWluZyBwcm9jZXNzZWQgYnkgdGhlIElFU0cuIFRoZXNlIGNvbW1lbnRz IHdlcmUgd3JpdHRlbiBwcmltYXJpbHkgZm9yIHRoZSBiZW5lZml0IG9mIHRoZSBzZWN1cml0eSBh cmVhIGRpcmVjdG9ycy4gRG9jdW1lbnQgZWRpdG9ycyBhbmQgV0cgY2hhaXJzIHNob3VsZCB0cmVh dCB0aGVzZSBjb21tZW50cyBqdXN0IGxpa2UgYW55IG90aGVyIGxhc3QgY2FsbCBjb21tZW50cy4N Cj4NCj4gSSBiZWxpZXZlIHRoZSBkb2N1bWVudCBpcyByZWFkeSB3aXRoIChwb3RlbnRpYWwpIGlz c3Vlcy4gIFRoZSDigJx3aXRoIGlzc3Vlc+KAnSBtaWdodCBiZSBkdWUgdG8gaWdub3JhbmNlIG9u IG15IHBhcnQuICBUaGUgZHJhZnQgZG9lcyBhIHZlcnkgZ29vZCBqb2Igb2YgZXhwbGFpbmluZyB0 aGUgY2Fub25pY2FsIGZvcm0gb2YgYSBKU09OIFdlYiBLZXkgdGhhdCBjYW4gYmUgdXNlZCBmb3Ig ZXN0YWJsaXNoaW5nIGEgdGh1bWJwcmludCB1bmRlciB2YXJ5aW5nIGNpcmN1bXN0YW5jZXMsIGNv bXBsZXRlIHdpdGggd2hhdCBJIGZvdW5kIHRvIGJlIGhlbHBmdWwgZXhhbXBsZXMuDQo+DQo+IFRo ZSBwcmltYXJ5IGlzc3VlIEkgaGF2ZSBpcyB0aGF0IGl04oCZcyB1bmNsZWFyIGhvdyByZWx5aW5n IHBhcnRpZXMgYXJlIGdvaW5nIHRvIGtub3cgd2hpY2ggaGFzaCBhbGdvcml0aG0gaGFzIGJlZW4g dXNlZC4gIFRoZSBleGFtcGxlcyB1c2UgU0hBLTI1NiwgYnV0IEnigJltIG5vdCBzZWVpbmcgd2hl cmUgU0hBLTI1NiBtaWdodCBiZSBzcGVjaWZpZWQgYXMgYSBNVVNUIG9yIGV2ZW4gYSBTSE9VTEQu ICBNb3Jlb3ZlciwgdGhlIGV4YW1wbGUgb3V0cHV0IHVsdGltYXRlbHkgc2hvd3Mgb25seSB0aGUg QmFzZS02NCBlbmNvZGluZyBvZiB0aGUgcmVzdWx0aW5nIGhhc2gsIHdoaWNoIHNheXMgbm90aGlu ZyBhYm91dCB0aGUgYWxnb3JpdGhtIHVzZWQgdG8gaWRlbnRpZnkgYSBrZXkuDQoNCkVhcmxpZXIg ZHJhZnRzIGhhZCBpbmNsdWRlZCBmaWVsZHMgd2hvc2UgbmFtZXMgd2VyZSBpbnRlbmRlZCB0byBj b21tdW5pY2F0ZSB0aGUgaW5mb3JtYXRpb24gYWJvdXQgdGhlIGhhc2ggZnVuY3Rpb24gdXNlZCAt IHNlZSB0aGUgImprdCIgZmllbGQgZGVmaW5pdGlvbnMgaW4gaHR0cDovL3Rvb2xzLmlldGYub3Jn L2h0bWwvZHJhZnQtaWV0Zi1qb3NlLWp3ay10aHVtYnByaW50LTAxI3NlY3Rpb24tNCAtIGJ1dCBz ZXZlcmFsIHdvcmtpbmcgZ3JvdXAgcmV2aWV3ZXJzIHN1Z2dlc3RlZCB0aGF0IHRoZXNlIGZpZWxk cyB3ZXJlIHVubmVjZXNzYXJ5IGFuZCB0aGF0IHRoZSB0eXBpY2FsIHVzYWdlIHdvdWxkIGJlIGFz ICJraWQiIChrZXkgSUQpIGZpZWxkIHZhbHVlcy4gIFdpdGggdGhhdCByZW1vdmFsLCBpdCBmYWxs cyBvbnRvIHRoZSBhcHBsaWNhdGlvbiB0byBzcGVjaWZ5IHRoZSBoYXNoIGFsZ29yaXRobSBmb3Ig aXRzIHBhcnRpY3VsYXIgdXNhZ2UuDQoNClRoaXMgaXNuJ3QgYXMgYmFkIGFzIHlvdSBtaWdodCB0 aGluaywgaG93ZXZlciwgYmVjYXVzZSB0eXBpY2FsbHkgdGhlIGNvbnN1bWVyIG9mIHRoZSAia2lk IiBkb2Vzbid0IG5lZWQgdG8ga25vdyB0aGUgYWxnb3JpdGhtIGJlY2F1c2UgaXQgd29uJ3QgYmUg cmVwcm9kdWNpbmcgdGhlIGNvbXB1dGF0aW9uLiAgSXQganVzdCByZWxpZXMgb24gdGhlIGZhY3Qg dGhhdCBhIHVuaXF1ZSBrZXkgSUQgdmFsdWUgd2FzIGdlbmVyYXRlZCBmb3IgdGhlIGtleSBhbmQg Y29tcGFyZXMgImtpZCIgdmFsdWVzIGFzIG9wYXF1ZSBzdHJpbmdzIHRvIGZpbmQgdGhlIGFwcHJv cHJpYXRlIGtleS4gIEluIHRoaXMgdXNhZ2UsIHRoZSBwcm9kdWNlciBvZiB0aGUga2V5IGlzIHRo ZSBvbmx5IHBhcnR5IHRoYXQgbmVlZHMgdG8ga25vdyB0aGUgaGFzaCBhbGdvcml0aG0gdGhhdCBp dCBpcyB1c2luZy4gIEkgaG9wZSB0aGlzIGhlbHBzLg0KDQo+IEFkZGl0aW9uYWxseSwgaW4gU2Vj dGlvbiA0LCDigJxKU09OIGFuZCBVbmljb2RlIENvbnNpZGVyYXRpb25z4oCdIHNvbWUg4oCcc2hv dWxk4oCdcyBhcmUgdXNlZCwgYnV0IEnigJltIG5vdCByZWFkaW5nIHRoZW0gYXMgU0hPVUxEcy4g IFNob3VsZCB0aGV5IGJlIFNIT1VMRHM/ICBGb3IgZXhhbXBsZSwgdGhlIHN0YXJ0IG9mIHRoZSB0 aGlyZCBwYXJhZ3JhcGggaW4gdGhhdCBzZWN0aW9uOiDigJxpZiBuZXcgSldLIG1lbWJlcnMgYXJl IGRlZmluZWQgdGhhdCB1c2Ugbm9uLUFTQ0lJIG1lbWJlciBuYW1lcywgdGhlaXIgZGVmaW5pdGlv bnMgc2hvdWxkIHNwZWNpZnkgdGhlIGV4YWN0IFVuaWNvZGUgY29kZSBwb2ludCBzZXF1ZW5jZXMg dXNlZCB0byByZXByZXNlbnQgdGhlbS7igJ0gIEl04oCZcyBub3QgY2xlYXIgdG8gbWUgd2hldGhl ciB0aGlzIGlzIGEgc3Ryb25nIHN0YXRlbWVudCBvciBqdXN0IGEgcmVjb21tZW5kYXRpb24gLSBp dCBzZWVtcyB0aGF0IHRoaXMgZHJhZnQgY291bGQgaGVscCB0aGUgZnV0dXJlIGJ5IG1ha2luZyBz dHJvbmdlciBzdGF0ZW1lbnRzIHRvIGVuY291cmFnZSBmdXR1cmUgaW50ZXJvcGVyYWJpbGl0eS4N Cg0KRm9yIHRoZSBvdGhlciBKT1NFIHNwZWNpZmljYXRpb25zLCBvdXIgY2hhaXIgSmltIFNjaGFh ZCB0b29rIHRoZSBwb3NpdGlvbiB0aGF0IFJGQyAyMTE5IGtleXdvcmRzIHNob3VsZCBiZSByZXNl cnZlZCBmb3IgdGVzdGFibGUgcHJvdG9jb2wgYmVoYXZpb3JzIGFuZCB0aGF0IG90aGVyIHVzZXMg b2YgdGhlIEVuZ2xpc2ggd29yZCAic2hvdWxkIiBzaG91bGQgbm90IHVzZSAiU0hPVUxEIi4gIFRo ZSBhdXRob3JzIGZvbGxvd2VkIHRoYXQgY29udmVudGlvbiBpbiB0aGlzIGRvY3VtZW50LiAgSSBk byB1bmRlcnN0YW5kIHRoYXQgb3RoZXIgYXV0aG9ycyBhbmQgd29ya2luZyBncm91cHMgaGF2ZSB0 YWtlbiBkaWZmZXJlbnQgcG9zaXRpb25zIGluIHRoaXMgcmVnYXJkLiAgSWYgdGhlcmUgYXJlIHBh cnRpY3VsYXIgdXNlcyB0aGF0IHlvdSBzdGlsbCBmZWVsIHNob3VsZCBiZSBjaGFuZ2VkIHRvIHVz ZSBSRkMgMjExOSBrZXl3b3JkcywgcGxlYXNlIGNhbGwgdGhlbSBvdXQuDQoNCj4gS2luZCByZWdh cmRzLA0KPiBBZGFtDQoNCgkJCQlUaGFua3MgYWdhaW4hDQoJCQkJLS0gTWlrZQ0KDQo=