Re: [stir] JWT/JSON (was - Re: Review of: draft-ietf-stir-passport-05)

[Eric Rescorla <[e-mail]>]

On Sun, Aug 21, 2016 at 9:29 AM, Dave Crocker <[e-mail]> wrote:

> On 8/21/2016 8:37 AM, Eric Rescorla wrote:
>
>> Dave,
>>
>> Whenever we want to add some cryptographic functionality to a
>> protocol [0] (especially when it's messaging/object security
>> functionality) we have to ask whether it would be better to define
>> something new, specific to the protocol, and hopefully simple, or
>> reuse something pre-existing, generic, and presumably more
>> complicated. In my experience, the history of those who take the
>> former approach is that we find ourselves reinventing a bunch of
>> stuff and that it's not as simple as we hoped [1][2]
>>
>
>
> We agree.
>
> I'm not sure what the point of saying here is, since it is highly
> consonant with points I have posted here more than once.


Well, I'm still wading through the traffic on the list, so sorry if I
missed them, but I took the message I was responding to be arguing that we
should not use JOSE here but rather should define something specific. Did I
misread you? If so, then I apologize and I would greatly appreciate it if
you could restate what you are proposing.

Thanks,
-Ekr


>
>
>
> d/
>
> --
>
>   Dave Crocker
>   Brandenburg InternetWorking
>   bbiw.net
>
> --
>
>   Dave Crocker
>   Brandenburg InternetWorking
>   bbiw.net
>