IETF Logo Mail Archive

Re: [Unbearable] JWS

Mike Jones <Michael.Jones@microsoft.com> Fri, 24 July 2015 18:50 UTC

Return-Path: <Michael.Jones@microsoft.com>
X-Original-To: unbearable@ietfa.amsl.com
Delivered-To: unbearable@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 61E751A6F3B for <unbearable@ietfa.amsl.com>; Fri, 24 Jul 2015 11:50:41 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: 0.088
X-Spam-Level:
X-Spam-Status: No, score=0.088 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=1.989, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ASIqMh8gKi2L for <unbearable@ietfa.amsl.com>; Fri, 24 Jul 2015 11:50:39 -0700 (PDT)
Received: from na01-by2-obe.outbound.protection.outlook.com (mail-by2on0127.outbound.protection.outlook.com [207.46.100.127]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 28C2A1A891B for <unbearable@ietf.org>; Fri, 24 Jul 2015 11:50:38 -0700 (PDT)
Received: from BY2PR03MB442.namprd03.prod.outlook.com (10.141.141.145) by BY2PR03MB444.namprd03.prod.outlook.com (10.141.141.154) with Microsoft SMTP Server (TLS) id 15.1.231.11; Fri, 24 Jul 2015 18:50:37 +0000
Received: from BY2PR03MB442.namprd03.prod.outlook.com ([10.141.141.145]) by BY2PR03MB442.namprd03.prod.outlook.com ([10.141.141.145]) with mapi id 15.01.0225.018; Fri, 24 Jul 2015 18:50:37 +0000
From: Mike Jones <Michael.Jones@microsoft.com>
To: Jim Fenton <fenton@bluepopcorn.net>, Tony Arcieri <bascule@gmail.com>, Martin Thomson <martin.thomson@gmail.com>
Thread-Topic: [Unbearable] JWS
Thread-Index: AQHQxf2LrXyN25oYS0WGLqzBTojPR53q642AgAAKc4CAAAA6UA==
Date: Fri, 24 Jul 2015 18:50:37 +0000
Message-ID: <BY2PR03MB4427BDF6346931B3D525605F5810@BY2PR03MB442.namprd03.prod.outlook.com>
References: <CABkgnnVFBRz44HwGwpmoc8PKk+5-Dq4Zxvu9k0TYB9dTnT58Og@mail.gmail.com> <CAHOTMV+MWvpbQh1S7PvVu0X8UKH8Zy9_pF1zwhv4yMAOajW=AA@mail.gmail.com> <55B287EB.2090301@bluepopcorn.net>
In-Reply-To: <55B287EB.2090301@bluepopcorn.net>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
authentication-results: bluepopcorn.net; dkim=none (message not signed) header.d=none;
x-originating-ip: [12.130.117.147]
x-microsoft-exchange-diagnostics: 1; BY2PR03MB444; 5:+MSI52qqghCDS/tC4zcvkIlKlTftSFuupjz/5tXV7EX61CEgqM9YY+IXndYESVHFouu0OMH2F1bw3oRUdjPHu0HQjNrdodb5xI8qhusyNz/3n1P8HoWc9TpOgUHP+DVLnjHlWyKh52HGZoDVosIvqg==; 24:SKeaTvOdRJuCCC3Nih9ItYP6iAS6/ri7wJNaF+qhUs94fc9a5wM2PHclODeP12/xExv2DQjqxYMLfXa0/pqFgNXxZFzAtLoQDyoGiHlPEA4=; 20:Pe2oW/EUSdlwTW4QTB7X+2EHcg3NQmBVUnyNvRqMeSMGV+GjeBim/EFaC9A7/TmaJfkDWHGxsfcdd0bh0PHp5Q==
x-microsoft-antispam: UriScan:;BCL:0;PCL:0;RULEID:;SRVR:BY2PR03MB444;
x-microsoft-antispam-prvs: <BY2PR03MB444B2E5FAACA22FC0D6332BF5810@BY2PR03MB444.namprd03.prod.outlook.com>
x-exchange-antispam-report-test: UriScan:(108003899814671);
x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(601004)(2401001)(5005006)(3002001); SRVR:BY2PR03MB444; BCL:0; PCL:0; RULEID:; SRVR:BY2PR03MB444;
x-forefront-prvs: 0647963F84
x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(377454003)(24454002)(479174004)(76576001)(2950100001)(87936001)(106116001)(99286002)(5001960100002)(2656002)(74316001)(77156002)(40100003)(92566002)(16236675004)(46102003)(19617315012)(62966003)(15395725005)(5001770100001)(5003600100002)(19580395003)(2900100001)(102836002)(77096005)(122556002)(19580405001)(10090500001)(15975445007)(189998001)(5002640100001)(86362001)(19625215002)(54356999)(33656002)(76176999)(50986999)(86612001)(19300405004)(66066001); DIR:OUT; SFP:1102; SCL:1; SRVR:BY2PR03MB444; H:BY2PR03MB442.namprd03.prod.outlook.com; FPR:; SPF:None; MLV:sfv; LANG:en;
Content-Type: multipart/alternative; boundary="_000_BY2PR03MB4427BDF6346931B3D525605F5810BY2PR03MB442namprd_"
MIME-Version: 1.0
X-OriginatorOrg: microsoft.com
X-MS-Exchange-CrossTenant-originalarrivaltime: 24 Jul 2015 18:50:37.0551 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BY2PR03MB444
Archived-At: <http://mailarchive.ietf.org/arch/msg/unbearable/DUPpae3cLtuylJMLocaFnfz1spQ>
Cc: "unbearable@ietf.org" <unbearable@ietf.org>
Subject: Re: [Unbearable] JWS
X-BeenThere: unbearable@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" <unbearable.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/unbearable>, <mailto:unbearable-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/unbearable/>
List-Post: <mailto:unbearable@ietf.org>
List-Help: <mailto:unbearable-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/unbearable>, <mailto:unbearable-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 24 Jul 2015 18:50:41 -0000

There's lots of interoperable, tested JWS libraries now for essentially every widely-used development platform.  See http://openid.net/developers/libraries/#jwt and http://jwt.io/, plus the blog post https://auth0.com/blog/2015/07/21/jwt-json-webtoken-logo/.

                                                            -- Mike

From: Unbearable [mailto:unbearable-bounces@ietf.org] On Behalf Of Jim Fenton
Sent: Friday, July 24, 2015 11:46 AM
To: Tony Arcieri; Martin Thomson
Cc: unbearable@ietf.org
Subject: Re: [Unbearable] JWS

On 7/24/15 11:08 AM, Tony Arcieri wrote:
On Fri, Jul 24, 2015 at 3:43 AM, Martin Thomson <martin.thomson@gmail.com<mailto:martin.thomson@gmail.com>> wrote:
Why aren't we using JWS?

This comes to mind:

https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries/<https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2fauth0.com%2fblog%2f2015%2f03%2f31%2fcritical-vulnerabilities-in-json-web-token-libraries%2f&data=01%7c01%7cMichael.Jones%40microsoft.com%7c603f029c57314343ca5a08d2945825a3%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=%2fPpfcHR%2f4S8VQAYL1B8FpD1zCRVcuPaYhvsGDoiWSQY%3d>

I would point to the fact that we (now) have libraries that have been vetted as a reason to use JWS, not the other way around.

(or maybe that's what you meant)

-Jim

v2.46.0 | Report a Bug | By Email | System Status