Return-Path: <ilari.liusvaara@elisanet.fi>
X-Original-To: unbearable@ietfa.amsl.com
Delivered-To: unbearable@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1])
 by ietfa.amsl.com (Postfix) with ESMTP id BCC521A883C
 for <unbearable@ietfa.amsl.com>; Sun, 26 Jul 2015 12:37:18 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.901
X-Spam-Level: 
X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5
 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001]
 autolearn=ham
Received: from mail.ietf.org ([4.31.198.44])
 by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024)
 with ESMTP id yaExkZHxDrew for <unbearable@ietfa.amsl.com>;
 Sun, 26 Jul 2015 12:37:17 -0700 (PDT)
Received: from emh03.mail.saunalahti.fi (emh03.mail.saunalahti.fi
 [62.142.5.109])
 (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits))
 (No client certificate requested)
 by ietfa.amsl.com (Postfix) with ESMTPS id E107E1A882F
 for <unbearable@ietf.org>; Sun, 26 Jul 2015 12:37:15 -0700 (PDT)
Received: from LK-Perkele-VII (a91-155-194-207.elisa-laajakaista.fi
 [91.155.194.207])
 by emh03.mail.saunalahti.fi (Postfix) with ESMTP id 01C831887D7
 for <unbearable@ietf.org>; Sun, 26 Jul 2015 22:37:12 +0300 (EEST)
Date: Sun, 26 Jul 2015 22:37:12 +0300
From: Ilari Liusvaara <ilari.liusvaara@elisanet.fi>
To: "unbearable@ietf.org" <unbearable@ietf.org>
Message-ID: <20150726193711.GA8628@LK-Perkele-VII>
References: <BY2PR03MB442B981834FD5B33291B020F5810@BY2PR03MB442.namprd03.prod.outlook.com>
 <301BBBAC-1CF8-43BD-9865-52D8F725BA84@ve7jtb.com>
 <CAHOTMV+VYnHUeFC1_xcWg6OVY42k4LDBcc2v119u86cgvgHj4Q@mail.gmail.com>
 <55B305FE.8050308@bluepopcorn.net>
 <CAHOTMVKe2rr-2VMMKCsCJx=mGz9coei75hNz-NYJOAHXyxCLDQ@mail.gmail.com>
 <BY2PR03MB442CC8201A4FED97C5E750BF5800@BY2PR03MB442.namprd03.prod.outlook.com>
 <CAHOTMVKN+daiHCpyZv=A0r1OyZiAoH=ofuaDhbActA8z2Z_HOw@mail.gmail.com>
 <B3616F77-34D5-41E2-A130-63C55AE8A323@oracle.com>
 <CAHOTMV+tYAjXjGms5tXYrizcdSNLTaeiCLMiFPRtE_PRXTS4PQ@mail.gmail.com>
 <B2B1C966-825F-4768-A1C5-23262B358CC0@oracle.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
In-Reply-To: <B2B1C966-825F-4768-A1C5-23262B358CC0@oracle.com>
User-Agent: Mutt/1.5.23 (2014-03-12)
Sender: Ilari Liusvaara <ilari.liusvaara@elisanet.fi>
Archived-At: <http://mailarchive.ietf.org/arch/msg/unbearable/QoybOl0cciDk0XfeDHjGKSg_YkA>
Subject: Re: [Unbearable] JWS
X-BeenThere: unbearable@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: "\"This list is for discussion of proposals for doing better than
 bearer tokens \(e.g. HTTP cookies,
 OAuth tokens etc.\) for web applications. The specific goal is chartering a WG
 focused on preventing security token export and replay attacks.\""
 <unbearable.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/unbearable>,
 <mailto:unbearable-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/unbearable/>
List-Post: <mailto:unbearable@ietf.org>
List-Help: <mailto:unbearable-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/unbearable>,
 <mailto:unbearable-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sun, 26 Jul 2015 19:37:18 -0000

On Sun, Jul 26, 2015 at 11:59:38AM -0700, Phil Hunt wrote:
>
> I think the use of JWS here is not introducing any new risks
> that we aren't already exposed to. 

JWS can represent inconsistent algorithms, the present format can not.

And there have been multiple very serious JWS library security
bugs due to inconsistent algorithms.



-Ilari