Subject: Re: [woes] BOF Chairs
From: Sean Turner <[email-masked]>
To: Joe Hildebrand <[email-masked]>, Mike Jones <[email-masked]>
Cc: "[email-masked]" <[email-masked]>, Paul Hoffman <[email-masked]>
Date: Fri, 24 Jun 2011 12:47:09 -0400
List-Id: "Web Object Encryption and Signing \(woes\) BOF discussion list" <woes.ietf.org>

(hand-slap) That'll teach me to do this from memory.

spt

On 6/24/11 12:41 PM, Joe Hildebrand wrote:
> As did I.
>
>
> On 6/24/11 10:14 AM, "Mike Jones"<[email-masked]>  wrote:
>
>> I proposed specific changes as well.
>>
>> -----Original Message-----
>> From: Sean Turner [mailto:[email-masked]]
>> Sent: Friday, June 24, 2011 9:12 AM
>> To: Paul Hoffman
>> Cc: Mike Jones; [email-masked]
>> Subject: Re: [woes] BOF Chairs
>>
>> On 6/24/11 11:37 AM, Paul Hoffman wrote:
>>> On Jun 24, 2011, at 8:05 AM, Mike Jones wrote:
>>>
>>>> Can you send a copy of the charter as currently revised to the list?  I know
>>>> that a number of comments came in on it, and would be good to see what the
>>>> present state of it is.
>>>
>>>
>>> Hannes, have you been tracking the charter changes? If not, Richard and I can
>>> do a first pass, but it would be better if you had done them.
>>
>> Paul,
>>
>> I think I was the only one that provided comments on the charter.
>> http://www.ietf.org/mail-archive/web/woes/current/msg00078.html
>> There was some push back on removing the references to the previous work.
>>
>> spt
>>
>> _______________________________________________
>> woes mailing list
>> [email-masked]
>> https://www.ietf.org/mailman/listinfo/woes
>
>

Date: Fri, 24 Jun 2011 10:41:15 -0600
From: Joe Hildebrand <[email-masked]>
To: Mike Jones <[email-masked]>, Sean Turner <[email-masked]>, Paul Hoffman <[email-masked]>
Cc: "[email-masked]" <[email-masked]>
Subject: Re: [woes] BOF Chairs

As did I.

On 6/24/11 10:14 AM, "Mike Jones" <[email-masked]> wrote:

> I proposed specific changes as well.
> 
> -----Original Message-----
> From: Sean Turner [mailto:[email-masked]]
> Sent: Friday, June 24, 2011 9:12 AM
> To: Paul Hoffman
> Cc: Mike Jones; [email-masked]
> Subject: Re: [woes] BOF Chairs
> 
> On 6/24/11 11:37 AM, Paul Hoffman wrote:
>> On Jun 24, 2011, at 8:05 AM, Mike Jones wrote:
>> 
>>> Can you send a copy of the charter as currently revised to the list?  I know
>>> that a number of comments came in on it, and would be good to see what the
>>> present state of it is.
>> 
>> 
>> Hannes, have you been tracking the charter changes? If not, Richard and I can
>> do a first pass, but it would be better if you had done them.
> 
> Paul,
> 
> I think I was the only one that provided comments on the charter.
> http://www.ietf.org/mail-archive/web/woes/current/msg00078.html
> There was some push back on removing the references to the previous work.
> 
> spt
> 
> _______________________________________________
> woes mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/woes

From: Mike Jones <[email-masked]>
To: Sean Turner <[email-masked]>, Paul Hoffman <[email-masked]>
Date: Fri, 24 Jun 2011 16:14:44 +0000
Accept-Language: en-US
Cc: "[email-masked]" <[email-masked]>
Subject: Re: [woes] BOF Chairs

I proposed specific changes as well.

-----Original Message-----
From: Sean Turner [mailto:[email-masked]]=20
Sent: Friday, June 24, 2011 9:12 AM
To: Paul Hoffman
Cc: Mike Jones; [email-masked]
Subject: Re: [woes] BOF Chairs

On 6/24/11 11:37 AM, Paul Hoffman wrote:
> On Jun 24, 2011, at 8:05 AM, Mike Jones wrote:
>
>> Can you send a copy of the charter as currently revised to the list?  I =
know that a number of comments came in on it, and would be good to see what=
 the present state of it is.
>
>
> Hannes, have you been tracking the charter changes? If not, Richard and I=
 can do a first pass, but it would be better if you had done them.

Paul,

I think I was the only one that provided comments on the charter.=20
http://www.ietf.org/mail-archive/web/woes/current/msg00078.html
There was some push back on removing the references to the previous work.

spt

Date: Fri, 24 Jun 2011 12:12:10 -0400
From: Sean Turner <[email-masked]>
To: Paul Hoffman <[email-masked]>
Cc: "[email-masked]" <[email-masked]>
Subject: Re: [woes] BOF Chairs

On 6/24/11 11:37 AM, Paul Hoffman wrote:
> On Jun 24, 2011, at 8:05 AM, Mike Jones wrote:
>
>> Can you send a copy of the charter as currently revised to the list?  I know that a number of comments came in on it, and would be good to see what the present state of it is.
>
>
> Hannes, have you been tracking the charter changes? If not, Richard and I can do a first pass, but it would be better if you had done them.

Paul,

I think I was the only one that provided comments on the charter. 
http://www.ietf.org/mail-archive/web/woes/current/msg00078.html
There was some push back on removing the references to the previous work.

spt

From: Paul Hoffman <[email-masked]>
Date: Fri, 24 Jun 2011 08:37:38 -0700
To: Mike Jones <[email-masked]>
Cc: "[email-masked]" <[email-masked]>
Subject: Re: [woes] BOF Chairs

On Jun 24, 2011, at 8:05 AM, Mike Jones wrote:

> Can you send a copy of the charter as currently revised to the list?  =
I know that a number of comments came in on it, and would be good to see =
what the present state of it is.

Hannes, have you been tracking the charter changes? If not, Richard and =
I can do a first pass, but it would be better if you had done them.

--Paul Hoffman

From: Mike Jones <[email-masked]>
To: Paul Hoffman <[email-masked]>, "[email-masked]" <[email-masked]>
Date: Fri, 24 Jun 2011 15:05:52 +0000
Accept-Language: en-US
Subject: Re: [woes] BOF Chairs

Can you send a copy of the charter as currently revised to the list?  I kno=
w that a number of comments came in on it, and would be good to see what th=
e present state of it is.

				Thanks,
				-- Mike

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Pau=
l Hoffman
Sent: Friday, June 24, 2011 8:00 AM
To: [email-masked]
Subject: Re: [woes] BOF Chairs

On Jun 24, 2011, at 7:42 AM, Sean Turner wrote:

> Paul Hoffman and Richard Barnes have agreed to be the BOF co-chairs. Than=
ks to them for stepping up.

And this BoF chair would like to make as much progress as possible *before*=
 Quebec, given that we already had a fairly BoFish meeting in Prague.

What do people on the list think that the status of the proposed charter is=
? Fairly baked? Needing different wording? Needing different starting steps=
? Needing different milestones?

--Paul Hoffman

_______________________________________________
woes mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/woes

From: Paul Hoffman <[email-masked]>
Date: Fri, 24 Jun 2011 08:00:23 -0700
To: [email-masked]
Subject: Re: [woes] BOF Chairs

On Jun 24, 2011, at 7:42 AM, Sean Turner wrote:

> Paul Hoffman and Richard Barnes have agreed to be the BOF co-chairs. =
Thanks to them for stepping up.

And this BoF chair would like to make as much progress as possible =
*before* Quebec, given that we already had a fairly BoFish meeting in =
Prague.

What do people on the list think that the status of the proposed charter =
is? Fairly baked? Needing different wording? Needing different starting =
steps? Needing different milestones?

--Paul Hoffman

Date: Fri, 24 Jun 2011 10:42:37 -0400
From: Sean Turner <[email-masked]>
To: [email-masked]
Subject: [woes] BOF Chairs

Paul Hoffman and Richard Barnes have agreed to be the BOF co-chairs. 
Thanks to them for stepping up.

spt

Date: Thu, 16 Jun 2011 19:31:56 -0600
From: Peter Saint-Andre <[email-masked]>
To: Kris Zyp <[email-masked]>
OpenPGP: url=http://www.saint-andre.com/me/stpeter.asc
Cc: Pete Resnick <[email-masked]>, [email-masked], "[email-masked]" <[email-masked]>
Subject: Re: [woes] WOES Charter Proposal

This is a cryptographically signed message in MIME format.

--------------ms010502040001040200020101
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

On 6/16/11 3:24 PM, Kris Zyp wrote:
> On 6/16/2011 3:03 PM, Peter Saint-Andre wrote:
>> Sure, it seems reasonable to discuss draft-zyp-json-schema-03 in the
>> Apps Area. It recently expired, so I'll ping the authors about bringin=
g
>> it back to life.
> Yes, that would be great to see JSON Schema moved under a WG. We are
> currently working on draft 04, although at this point things have very
> much stabilized and most of the updates we are doing are editorial. We
> can try to speed that up if need be.
> Thanks,
> Kris

Hi Kris,

It's good to hear that you're still working on this spec. I'll contact
you and Gary offlist about how to proceed.

Peter

--=20
Peter Saint-Andre
https://stpeter.im/

--------------ms010502040001040200020101
Content-Type: application/pkcs7-signature; name="smime.p7s"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="smime.p7s"
Content-Description: S/MIME Cryptographic Signature

AAAA
--------------ms010502040001040200020101--

Date: Thu, 16 Jun 2011 15:03:27 -0600
From: Peter Saint-Andre <[email-masked]>
To: Joe Hildebrand <[email-masked]>
OpenPGP: url=http://www.saint-andre.com/me/stpeter.asc
Cc: "[email-masked]" <[email-masked]>, Peter Saint-Andre <[email-masked]>, [email-masked], "<[email-masked]>" <[email-masked]>, Pete Resnick <[email-masked]>
Subject: Re: [woes] WOES Charter Proposal

This is a cryptographically signed message in MIME format.

--------------ms010003000100030708060801
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

Sure, it seems reasonable to discuss draft-zyp-json-schema-03 in the
Apps Area. It recently expired, so I'll ping the authors about bringing
it back to life.

On 6/16/11 2:29 PM, Joe Hildebrand wrote:
> Kris has most of what we need already in his JSON Schema draft.
>=20
>=20
> On 6/16/11 2:14 PM, "Stephen Farrell" <[email-masked]> wrote=
:
>=20
>> I guess I'd worry about the added time if its a dependency but maybe t=
here're
>> ways around that. (Developing new schema stuff sounds to me like a slo=
oow
>> thing;-)
>>
>> S
>>
>> On 16 Jun 2011, at 20:43, "Peter Saint Andre" <Peter.SaintAndre@webex.=
com>
>> wrote:
>>
>>> Yes, that seems not unreasonable.
>>>
>>> ----- Original Message -----
>>> From: Joe Hildebrand
>>> To: Stephen Farrell <[email-masked]>
>>> Cc: Mike Jones <[email-masked]>; Tschofenig, Hannes (NSN=
 -
>>> FI/Espoo) <[email-masked]>; ext Manger, James H
>>> <[email-masked]>; Sean Turner <[email-masked]>;
>>> [email-masked] <[email-masked]>; [email-masked] <[email-masked]>; P=
eter
>>> Saint Andre; Pete Resnick <[email-masked]>
>>> Sent: Thu Jun 16 12:21:56 2011
>>> Subject: Re: [woes] WOES Charter Proposal
>>>
>>> Agree that 4 is scope creep that is outside of the scope of normal se=
curity
>>> area stuff, but it's likely to be a prereq.  I'm fine with dropping i=
t from
>>> the charter, potentially getting support from the Apps ADs to move st=
uff
>>> like JSON Schema through the Apps AWG.
>>>
>>>
>>> On 6/16/11 11:51 AM, "Stephen Farrell" <[email-masked]> wr=
ote:
>>>
>>>>
>>>> 3 & 4 there look a bit like scope-creep to me
>>>>
>>>> Why are they absolutely needed?
>>>>
>>>> S.
>>>>
>>>> On 16/06/11 18:33, Joe Hildebrand wrote:
>>>>> Slight tweaks
>>>>>
>>>>>
>>>>> On 6/16/11 11:26 AM, "Mike Jones" <[email-masked]> wro=
te:
>>>>>
>>>>>>    1) A JSON-based method of applying digital signatures and keyed=
 message
>>>>>> digests to data that may represent JSON data structures.
>>>>>
>>>>> ... may represent arbitrary data, including JSON data structures an=
d text
>>>>>
>>>>>>    2) A JSON-based method of applying encryption to data that may
>>>>>> represent
>>>>>> JSON data structures.
>>>>>
>>>>> Same as 1) above.  Not just for JSON.
>>>>>
>>>>>> Separately, we may want to consider whether the following should b=
e in
>>>>>> scope:
>>>>>>
>>>>>>    3) A JSON-based method of representing public keys.
>>>>>>
>>>>>> Also, please update and/or add these references (some were out of =
date,
>>>>>> some
>>>>>> were missing):
>>>>>
>>>>> Let's also add:
>>>>>
>>>>> 4) Any JSON-specific prerequisite tooling such as JSON Schema
>>>>>
>>>>> And add draft-zyp-json-schema as a reference.  I CC'd Kris Zyp to s=
ee if
>>>>> he's ok with that.  Kris: this might be a chance for a WG to pick u=
p JSON
>>>>> Schema if you like.
>>>>>
>>>
>>> --=20
>>> Joe Hildebrand
>>>

--------------ms010003000100030708060801
Content-Type: application/pkcs7-signature; name="smime.p7s"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="smime.p7s"
Content-Description: S/MIME Cryptographic Signature

AAAA
--------------ms010003000100030708060801--

Date: Thu, 16 Jun 2011 14:29:35 -0600
From: Joe Hildebrand <[email-masked]>
To: Stephen Farrell <[email-masked]>, Peter Saint-Andre <[email-masked]>
IM-ID: xmpp:[email-masked]
Presence-ID: xmpp:[email-masked]
Jabber-ID: [email-masked]
Cc: "[email-masked]" <[email-masked]>, "<[email-masked]>" <[email-masked]>, Pete Resnick <[email-masked]>
Subject: Re: [woes] WOES Charter Proposal

Kris has most of what we need already in his JSON Schema draft.

On 6/16/11 2:14 PM, "Stephen Farrell" <[email-masked]> wrote:

> I guess I'd worry about the added time if its a dependency but maybe there're
> ways around that. (Developing new schema stuff sounds to me like a slooow
> thing;-)
> 
> S
> 
> On 16 Jun 2011, at 20:43, "Peter Saint Andre" <[email-masked]>
> wrote:
> 
>> Yes, that seems not unreasonable.
>> 
>> ----- Original Message -----
>> From: Joe Hildebrand
>> To: Stephen Farrell <[email-masked]>
>> Cc: Mike Jones <[email-masked]>; Tschofenig, Hannes (NSN -
>> FI/Espoo) <[email-masked]>; ext Manger, James H
>> <[email-masked]>; Sean Turner <[email-masked]>;
>> [email-masked] <[email-masked]>; [email-masked] <[email-masked]>; Peter
>> Saint Andre; Pete Resnick <[email-masked]>
>> Sent: Thu Jun 16 12:21:56 2011
>> Subject: Re: [woes] WOES Charter Proposal
>> 
>> Agree that 4 is scope creep that is outside of the scope of normal security
>> area stuff, but it's likely to be a prereq.  I'm fine with dropping it from
>> the charter, potentially getting support from the Apps ADs to move stuff
>> like JSON Schema through the Apps AWG.
>> 
>> 
>> On 6/16/11 11:51 AM, "Stephen Farrell" <[email-masked]> wrote:
>> 
>>> 
>>> 3 & 4 there look a bit like scope-creep to me
>>> 
>>> Why are they absolutely needed?
>>> 
>>> S.
>>> 
>>> On 16/06/11 18:33, Joe Hildebrand wrote:
>>>> Slight tweaks
>>>> 
>>>> 
>>>> On 6/16/11 11:26 AM, "Mike Jones" <[email-masked]> wrote:
>>>> 
>>>>>    1) A JSON-based method of applying digital signatures and keyed message
>>>>> digests to data that may represent JSON data structures.
>>>> 
>>>> ... may represent arbitrary data, including JSON data structures and text
>>>> 
>>>>>    2) A JSON-based method of applying encryption to data that may
>>>>> represent
>>>>> JSON data structures.
>>>> 
>>>> Same as 1) above.  Not just for JSON.
>>>> 
>>>>> Separately, we may want to consider whether the following should be in
>>>>> scope:
>>>>> 
>>>>>    3) A JSON-based method of representing public keys.
>>>>> 
>>>>> Also, please update and/or add these references (some were out of date,
>>>>> some
>>>>> were missing):
>>>> 
>>>> Let's also add:
>>>> 
>>>> 4) Any JSON-specific prerequisite tooling such as JSON Schema
>>>> 
>>>> And add draft-zyp-json-schema as a reference.  I CC'd Kris Zyp to see if
>>>> he's ok with that.  Kris: this might be a chance for a WG to pick up JSON
>>>> Schema if you like.
>>>> 
>> 
>> -- 
>> Joe Hildebrand
>> 

-- 
Joe Hildebrand

From: Stephen Farrell <[email-masked]>
Date: Thu, 16 Jun 2011 21:14:20 +0100
To: Peter Saint Andre <[email-masked]>
Cc: "<[email-masked]>" <[email-masked]>, "<[email-masked]>" <[email-masked]>, "<[email-masked]>" <[email-masked]>
Subject: Re: [woes] WOES Charter Proposal

I guess I'd worry about the added time if its a dependency but maybe there'r=
e ways around that. (Developing new schema stuff sounds to me like a slooow t=
hing;-)

S

On 16 Jun 2011, at 20:43, "Peter Saint Andre" <[email-masked]> w=
rote:

> Yes, that seems not unreasonable.
>=20
> ----- Original Message -----
> From: Joe Hildebrand
> To: Stephen Farrell <[email-masked]>
> Cc: Mike Jones <[email-masked]>; Tschofenig, Hannes (NSN - FI=
/Espoo) <[email-masked]>; ext Manger, James H <James.H.Manger@tea=
m.telstra.com>; Sean Turner <[email-masked]>; [email-masked] <[email-masked]=
>; [email-masked] <[email-masked]>; Peter Saint Andre; Pete Resnick <pre=
[email-masked]>
> Sent: Thu Jun 16 12:21:56 2011
> Subject: Re: [woes] WOES Charter Proposal
>=20
> Agree that 4 is scope creep that is outside of the scope of normal securit=
y
> area stuff, but it's likely to be a prereq.  I'm fine with dropping it fro=
m
> the charter, potentially getting support from the Apps ADs to move stuff
> like JSON Schema through the Apps AWG.
>=20
>=20
> On 6/16/11 11:51 AM, "Stephen Farrell" <[email-masked]> wrote:
>=20
>>=20
>> 3 & 4 there look a bit like scope-creep to me
>>=20
>> Why are they absolutely needed?
>>=20
>> S.
>>=20
>> On 16/06/11 18:33, Joe Hildebrand wrote:
>>> Slight tweaks
>>>=20
>>>=20
>>> On 6/16/11 11:26 AM, "Mike Jones" <[email-masked]> wrote:
>>>=20
>>>>    1) A JSON-based method of applying digital signatures and keyed mess=
age
>>>> digests to data that may represent JSON data structures.
>>>=20
>>> ... may represent arbitrary data, including JSON data structures and tex=
t
>>>=20
>>>>    2) A JSON-based method of applying encryption to data that may repre=
sent
>>>> JSON data structures.
>>>=20
>>> Same as 1) above.  Not just for JSON.
>>>=20
>>>> Separately, we may want to consider whether the following should be in
>>>> scope:
>>>>=20
>>>>    3) A JSON-based method of representing public keys.
>>>>=20
>>>> Also, please update and/or add these references (some were out of date,=
 some
>>>> were missing):
>>>=20
>>> Let's also add:
>>>=20
>>> 4) Any JSON-specific prerequisite tooling such as JSON Schema
>>>=20
>>> And add draft-zyp-json-schema as a reference.  I CC'd Kris Zyp to see if=

>>> he's ok with that.  Kris: this might be a chance for a WG to pick up JSO=
N
>>> Schema if you like.
>>>=20
>=20
> --=20
> Joe Hildebrand
>=20

Date: Thu, 16 Jun 2011 13:21:56 -0600
From: Joe Hildebrand <[email-masked]>
To: Stephen Farrell <[email-masked]>
IM-ID: xmpp:[email-masked]
Presence-ID: xmpp:[email-masked]
Jabber-ID: [email-masked]
Cc: Peter Saint-Andre <[email-masked]>, "[email-masked]" <[email-masked]>, [email-masked], Pete Resnick <[email-masked]>
Subject: Re: [woes] WOES Charter Proposal

Agree that 4 is scope creep that is outside of the scope of normal security
area stuff, but it's likely to be a prereq.  I'm fine with dropping it from
the charter, potentially getting support from the Apps ADs to move stuff
like JSON Schema through the Apps AWG.

On 6/16/11 11:51 AM, "Stephen Farrell" <[email-masked]> wrote:

> 
> 3 & 4 there look a bit like scope-creep to me
> 
> Why are they absolutely needed?
> 
> S.
> 
> On 16/06/11 18:33, Joe Hildebrand wrote:
>> Slight tweaks
>> 
>> 
>> On 6/16/11 11:26 AM, "Mike Jones" <[email-masked]> wrote:
>> 
>>>     1) A JSON-based method of applying digital signatures and keyed message
>>> digests to data that may represent JSON data structures.
>> 
>> ... may represent arbitrary data, including JSON data structures and text
>> 
>>>     2) A JSON-based method of applying encryption to data that may represent
>>> JSON data structures.
>> 
>> Same as 1) above.  Not just for JSON.
>> 
>>> Separately, we may want to consider whether the following should be in
>>> scope:
>>> 
>>>     3) A JSON-based method of representing public keys.
>>> 
>>> Also, please update and/or add these references (some were out of date, some
>>> were missing):
>> 
>> Let's also add:
>> 
>> 4) Any JSON-specific prerequisite tooling such as JSON Schema
>> 
>> And add draft-zyp-json-schema as a reference.  I CC'd Kris Zyp to see if
>> he's ok with that.  Kris: this might be a chance for a WG to pick up JSON
>> Schema if you like.
>> 

-- 
Joe Hildebrand

From: Mike Jones <[email-masked]>
To: Stephen Farrell <[email-masked]>
Date: Thu, 16 Jun 2011 18:47:02 +0000
Accept-Language: en-US
Cc: "[email-masked]" <[email-masked]>, "[email-masked]" <[email-masked]>
Subject: Re: [woes] WOES Charter Proposal

For what it's worth, the HMAC and signature output representations to use *=
are* explicitly specified in the JWS and JWT specs (which is necessary to a=
chieve interoperability).

				-- Mike

-----Original Message-----
From: Stephen Farrell [mailto:[email-masked]]=20
Sent: Thursday, June 16, 2011 11:43 AM
To: Mike Jones
Cc: Joe Hildebrand; Tschofenig, Hannes (NSN - FI/Espoo); extManger, James H=
; Sean Turner; [email-masked]; [email-masked]
Subject: Re: [woes] WOES Charter Proposal

On 16 Jun 2011, at 19:14, Mike Jones <[email-masked]> wrote:

> About (3), you sign and encrypt things with keys.  The header/envelope of=
ten references the key, which must have a known representation.  In a JSON-=
based world, it's often simpler to represent public keys as JSON rather tha=
n ASN.1 (for the same reasons that we're considering JSON signatures and en=
cryption when we already have CMS).  It's not creep - it's providing a comp=
lete JSON-based signing/encryption solution.

And you need algorithm ids and parameters and a way to represent hmac outpu=
ts etc but those are not called out specifically which makes (3) look like =
a slippery slope.

>=20
> I personal agree that (4) schemas is creep, but I support Joe's desire to=
 have it considered as an input document.

I'm thinking in charter terms, this is the first I think I've heard of non =
crypto work being proposed here (sorry if I missed that).

Simpler, more tightly scoped, charters seem to get approved easier,

Cheers=20
S

>=20
>                -- Mike
>=20
> -----Original Message-----
> From: Stephen Farrell [mailto:[email-masked]]=20
> Sent: Thursday, June 16, 2011 10:52 AM
> To: Joe Hildebrand
> Cc: Mike Jones; Tschofenig, Hannes (NSN - FI/Espoo); ext Manger, James H;=
 Sean Turner; [email-masked]; [email-masked]
> Subject: Re: [woes] WOES Charter Proposal
>=20
>=20
> 3 & 4 there look a bit like scope-creep to me
>=20
> Why are they absolutely needed?
>=20
> S.
>=20
> On 16/06/11 18:33, Joe Hildebrand wrote:
>> Slight tweaks
>>=20
>>=20
>> On 6/16/11 11:26 AM, "Mike Jones" <[email-masked]> wrote:
>>=20
>>>    1) A JSON-based method of applying digital signatures and keyed=20
>>> message digests to data that may represent JSON data structures.
>>=20
>> ... may represent arbitrary data, including JSON data structures and=20
>> text
>>=20
>>>    2) A JSON-based method of applying encryption to data that may=20
>>> represent JSON data structures.
>>=20
>> Same as 1) above.  Not just for JSON.
>>=20
>>> Separately, we may want to consider whether the following should be in =
scope:
>>>=20
>>>    3) A JSON-based method of representing public keys.
>>>=20
>>> Also, please update and/or add these references (some were out of=20
>>> date, some were missing):
>>=20
>> Let's also add:
>>=20
>> 4) Any JSON-specific prerequisite tooling such as JSON Schema
>>=20
>> And add draft-zyp-json-schema as a reference.  I CC'd Kris Zyp to see=20
>> if he's ok with that.  Kris: this might be a chance for a WG to pick=20
>> up JSON Schema if you like.
>>=20
>=20

From: Stephen Farrell <[email-masked]>
Date: Thu, 16 Jun 2011 19:43:28 +0100
To: Mike Jones <[email-masked]>
Cc: "[email-masked]" <[email-masked]>, "[email-masked]" <[email-masked]>
Subject: Re: [woes] WOES Charter Proposal

On 16 Jun 2011, at 19:14, Mike Jones <[email-masked]> wrote:

> About (3), you sign and encrypt things with keys.  The header/envelope oft=
en references the key, which must have a known representation.  In a JSON-ba=
sed world, it's often simpler to represent public keys as JSON rather than A=
SN.1 (for the same reasons that we're considering JSON signatures and encryp=
tion when we already have CMS).  It's not creep - it's providing a complete J=
SON-based signing/encryption solution.

And you need algorithm ids and parameters and a way to represent hmac output=
s etc but those are not called out specifically which makes (3) look like a s=
lippery slope.

>=20
> I personal agree that (4) schemas is creep, but I support Joe's desire to h=
ave it considered as an input document.

I'm thinking in charter terms, this is the first I think I've heard of non c=
rypto work being proposed here (sorry if I missed that).

Simpler, more tightly scoped, charters seem to get approved easier,

Cheers=20
S

>=20
>                -- Mike
>=20
> -----Original Message-----
> From: Stephen Farrell [mailto:[email-masked]]=20
> Sent: Thursday, June 16, 2011 10:52 AM
> To: Joe Hildebrand
> Cc: Mike Jones; Tschofenig, Hannes (NSN - FI/Espoo); ext Manger, James H; S=
ean Turner; [email-masked]; [email-masked]
> Subject: Re: [woes] WOES Charter Proposal
>=20
>=20
> 3 & 4 there look a bit like scope-creep to me
>=20
> Why are they absolutely needed?
>=20
> S.
>=20
> On 16/06/11 18:33, Joe Hildebrand wrote:
>> Slight tweaks
>>=20
>>=20
>> On 6/16/11 11:26 AM, "Mike Jones" <[email-masked]> wrote:
>>=20
>>>    1) A JSON-based method of applying digital signatures and keyed=20
>>> message digests to data that may represent JSON data structures.
>>=20
>> ... may represent arbitrary data, including JSON data structures and=20
>> text
>>=20
>>>    2) A JSON-based method of applying encryption to data that may=20
>>> represent JSON data structures.
>>=20
>> Same as 1) above.  Not just for JSON.
>>=20
>>> Separately, we may want to consider whether the following should be in s=
cope:
>>>=20
>>>    3) A JSON-based method of representing public keys.
>>>=20
>>> Also, please update and/or add these references (some were out of=20
>>> date, some were missing):
>>=20
>> Let's also add:
>>=20
>> 4) Any JSON-specific prerequisite tooling such as JSON Schema
>>=20
>> And add draft-zyp-json-schema as a reference.  I CC'd Kris Zyp to see=20
>> if he's ok with that.  Kris: this might be a chance for a WG to pick=20
>> up JSON Schema if you like.
>>=20
>=20

From: Mike Jones <[email-masked]>
To: Stephen Farrell <[email-masked]>, Joe Hildebrand <[email-masked]>
Date: Thu, 16 Jun 2011 18:14:43 +0000
Accept-Language: en-US
Cc: "[email-masked]" <[email-masked]>, "[email-masked]" <[email-masked]>
Subject: Re: [woes] WOES Charter Proposal

About (3), you sign and encrypt things with keys.  The header/envelope ofte=
n references the key, which must have a known representation.  In a JSON-ba=
sed world, it's often simpler to represent public keys as JSON rather than =
ASN.1 (for the same reasons that we're considering JSON signatures and encr=
yption when we already have CMS).  It's not creep - it's providing a comple=
te JSON-based signing/encryption solution.

I personal agree that (4) schemas is creep, but I support Joe's desire to h=
ave it considered as an input document.

				-- Mike

-----Original Message-----
From: Stephen Farrell [mailto:[email-masked]]=20
Sent: Thursday, June 16, 2011 10:52 AM
To: Joe Hildebrand
Cc: Mike Jones; Tschofenig, Hannes (NSN - FI/Espoo); ext Manger, James H; S=
ean Turner; [email-masked]; [email-masked]
Subject: Re: [woes] WOES Charter Proposal

3 & 4 there look a bit like scope-creep to me

Why are they absolutely needed?

S.

On 16/06/11 18:33, Joe Hildebrand wrote:
> Slight tweaks
>=20
>=20
> On 6/16/11 11:26 AM, "Mike Jones" <[email-masked]> wrote:
>=20
>>     1) A JSON-based method of applying digital signatures and keyed=20
>> message digests to data that may represent JSON data structures.
>=20
> ... may represent arbitrary data, including JSON data structures and=20
> text
>=20
>>     2) A JSON-based method of applying encryption to data that may=20
>> represent JSON data structures.
>=20
> Same as 1) above.  Not just for JSON.
>=20
>> Separately, we may want to consider whether the following should be in s=
cope:
>>
>>     3) A JSON-based method of representing public keys.
>>
>> Also, please update and/or add these references (some were out of=20
>> date, some were missing):
>=20
> Let's also add:
>=20
> 4) Any JSON-specific prerequisite tooling such as JSON Schema
>=20
> And add draft-zyp-json-schema as a reference.  I CC'd Kris Zyp to see=20
> if he's ok with that.  Kris: this might be a chance for a WG to pick=20
> up JSON Schema if you like.
>=20

Date: Thu, 16 Jun 2011 18:51:58 +0100
From: Stephen Farrell <[email-masked]>
To: Joe Hildebrand <[email-masked]>
Cc: "[email-masked]" <[email-masked]>, [email-masked]
Subject: Re: [woes] WOES Charter Proposal

3 & 4 there look a bit like scope-creep to me

Why are they absolutely needed?

S.

On 16/06/11 18:33, Joe Hildebrand wrote:
> Slight tweaks
> 
> 
> On 6/16/11 11:26 AM, "Mike Jones" <[email-masked]> wrote:
> 
>>     1) A JSON-based method of applying digital signatures and keyed message
>> digests to data that may represent JSON data structures.
> 
> ... may represent arbitrary data, including JSON data structures and text
> 
>>     2) A JSON-based method of applying encryption to data that may represent
>> JSON data structures.
> 
> Same as 1) above.  Not just for JSON.
> 
>> Separately, we may want to consider whether the following should be in scope:
>>
>>     3) A JSON-based method of representing public keys.
>>
>> Also, please update and/or add these references (some were out of date, some
>> were missing):
> 
> Let's also add:
> 
> 4) Any JSON-specific prerequisite tooling such as JSON Schema
> 
> And add draft-zyp-json-schema as a reference.  I CC'd Kris Zyp to see if
> he's ok with that.  Kris: this might be a chance for a WG to pick up JSON
> Schema if you like.
> 

From: Mike Jones <[email-masked]>
To: Joe Hildebrand <[email-masked]>, "Tschofenig, Hannes (NSN - FI/Espoo)" <[email-masked]>, "ext Manger, James H" <[email-masked]>, Sean Turner <[email-masked]>, "[email-masked]" <[email-masked]>, "[email-masked]" <[email-masked]>
Date: Thu, 16 Jun 2011 17:48:56 +0000
Accept-Language: en-US
Subject: Re: [woes] WOES Charter Proposal

Agreed

-----Original Message-----
From: Joe Hildebrand [mailto:[email-masked]]=20
Sent: Thursday, June 16, 2011 10:33 AM
To: Mike Jones; Tschofenig, Hannes (NSN - FI/Espoo); ext Manger, James H; S=
ean Turner; [email-masked]; [email-masked]
Subject: Re: [woes] WOES Charter Proposal

Slight tweaks

On 6/16/11 11:26 AM, "Mike Jones" <[email-masked]> wrote:

>     1) A JSON-based method of applying digital signatures and keyed=20
> message digests to data that may represent JSON data structures.

... may represent arbitrary data, including JSON data structures and text

>     2) A JSON-based method of applying encryption to data that may=20
> represent JSON data structures.

Same as 1) above.  Not just for JSON.

> Separately, we may want to consider whether the following should be in sc=
ope:
>=20
>     3) A JSON-based method of representing public keys.
>=20
> Also, please update and/or add these references (some were out of=20
> date, some were missing):

Let's also add:

4) Any JSON-specific prerequisite tooling such as JSON Schema

And add draft-zyp-json-schema as a reference.  I CC'd Kris Zyp to see if he=
's ok with that.  Kris: this might be a chance for a WG to pick up JSON Sch=
ema if you like.

--
Joe Hildebrand

Date: Thu, 16 Jun 2011 11:33:11 -0600
From: Joe Hildebrand <[email-masked]>
To: Mike Jones <[email-masked]>, "Tschofenig, Hannes (NSN - FI/Espoo)" <[email-masked]>, "ext Manger, James H" <[email-masked]>, Sean Turner <[email-masked]>, "[email-masked]" <[email-masked]>, <[email-masked]>
IM-ID: xmpp:[email-masked]
Presence-ID: xmpp:[email-masked]
Jabber-ID: [email-masked]
Subject: Re: [woes] WOES Charter Proposal

Slight tweaks

On 6/16/11 11:26 AM, "Mike Jones" <[email-masked]> wrote:

>     1) A JSON-based method of applying digital signatures and keyed message
> digests to data that may represent JSON data structures.

... may represent arbitrary data, including JSON data structures and text

>     2) A JSON-based method of applying encryption to data that may represent
> JSON data structures.

Same as 1) above.  Not just for JSON.

> Separately, we may want to consider whether the following should be in scope:
> 
>     3) A JSON-based method of representing public keys.
> 
> Also, please update and/or add these references (some were out of date, some
> were missing):

Let's also add:

4) Any JSON-specific prerequisite tooling such as JSON Schema

And add draft-zyp-json-schema as a reference.  I CC'd Kris Zyp to see if
he's ok with that.  Kris: this might be a chance for a WG to pick up JSON
Schema if you like.

-- 
Joe Hildebrand

From: Mike Jones <[email-masked]>
To: "Tschofenig, Hannes (NSN - FI/Espoo)" <[email-masked]>, "ext Manger, James H" <[email-masked]>, Sean Turner <[email-masked]>, "[email-masked]" <[email-masked]>
Date: Thu, 16 Jun 2011 17:26:37 +0000
Accept-Language: en-US
Subject: Re: [woes] WOES Charter Proposal

One change I'd request to the draft charter is that the group should be cha=
rtered to produce one or more documents - not exactly two documents, per th=
e current proposal.  That leaves the working group free to factor the solut=
ion as makes best sense to the group.  I'd change that section of the docum=
ent to:

    This group is chartered to work on one or more Standards Track document=
s defining the following functionality:=20

    1) A JSON-based method of applying digital signatures and keyed message=
 digests to data that may represent JSON data structures.

    2) A JSON-based method of applying encryption to data that may represen=
t JSON data structures.

Separately, we may want to consider whether the following should be in scop=
e:

    3) A JSON-based method of representing public keys.

Also, please update and/or add these references (some were out of date, som=
e were missing):

    [JWS] M. Jones, et al. "JSON Web Signature (JWS)", draft-jones-json-web=
-signature-02 (work in progress), Apr. 2011.

    [JWT] M. Jones, et al. "JSON Web Token (JWT)", draft-jones-json-web-tok=
en-04 (work in progress), Mar. 2011.

    [JWK] M. Jones. "JSON Web Key (JWK)", draft-jones-json-web-token-00 (wo=
rk in progress), Apr. 2011.

				Thanks,
				-- Mike

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Tsc=
hofenig, Hannes (NSN - FI/Espoo)
Sent: Wednesday, June 15, 2011 12:44 AM
To: ext Manger, James H; Sean Turner; [email-masked]
Subject: Re: [woes] WOES Charter Proposal

I put the JSON background there because the purpose of the working group is=
 meant to be understood also by those who have not been involved in the wor=
k. =20

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf=20
> Of ext Manger, James H
> Sent: Wednesday, June 15, 2011 4:07 AM
> To: Sean Turner; [email-masked]
> Subject: Re: [woes] WOES Charter Proposal
>=20
> Sean,
>=20
> I would make almost the opposite edits to the charter than you.
> I think it is really helpful that the charter lists different existing=20
> proposals (JWT, SWT, MagicSigs, JSS, JSMS). They provides a great=20
> context for the WG; they show different approaches; they show people=20
> want something in this space.
> I think most of the JSON background can be dropped.
>=20
>=20
>   >Thanks for kicking this off Hannes.  In Prague, I thought the goal=20
> was
>   >pretty straightforward: JSONize CMS.  To that end I think we can=20
> clip
>   >out some of the references to work already done.  The BOF can=20
> decide
>   >later what draft is the basis for the starting point.
>=20
>   ...
>   <delete>
>   > Different proposals for providing these
>   > security services have been defined and implemented.=20
> Examples are: JSON
>   > Web Token [JWT], Simple Web Tokens [SWT], Magic Signatures
>   > [MagicSignatures], JSON Simple Sign [JSS], JavaScript Message=20
> Security
>   > Format [JSMS].
>   </delete>
>=20
> _______________________________________________
> woes mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/woes
>=20
_______________________________________________
woes mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/woes

Content-class: urn:content-classes:message
Date: Wed, 15 Jun 2011 10:44:29 +0300
From: "Tschofenig, Hannes (NSN - FI/Espoo)" <[email-masked]>
To: "ext Manger, James H" <[email-masked]>, "Sean Turner" <[email-masked]>, <[email-masked]>
Subject: Re: [woes] WOES Charter Proposal

I put the JSON background there because the purpose of the working group
is meant to be understood also by those who have not been involved in
the work. =20

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On=20
> Behalf Of ext Manger, James H
> Sent: Wednesday, June 15, 2011 4:07 AM
> To: Sean Turner; [email-masked]
> Subject: Re: [woes] WOES Charter Proposal
>=20
> Sean,
>=20
> I would make almost the opposite edits to the charter than you.
> I think it is really helpful that the charter lists different=20
> existing proposals (JWT, SWT, MagicSigs, JSS, JSMS). They=20
> provides a great context for the WG; they show different=20
> approaches; they show people want something in this space.
> I think most of the JSON background can be dropped.
>=20
>=20
>   >Thanks for kicking this off Hannes.  In Prague, I thought=20
> the goal was=20
>   >pretty straightforward: JSONize CMS.  To that end I think=20
> we can clip=20
>   >out some of the references to work already done.  The BOF=20
> can decide=20
>   >later what draft is the basis for the starting point.
>=20
>   ...
>   <delete>
>   > Different proposals for providing these
>   > security services have been defined and implemented.=20
> Examples are: JSON
>   > Web Token [JWT], Simple Web Tokens [SWT], Magic Signatures
>   > [MagicSignatures], JSON Simple Sign [JSS], JavaScript=20
> Message Security
>   > Format [JSMS].
>   </delete>
>=20
> _______________________________________________
> woes mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/woes
>=20

From: "Manger, James H" <[email-masked]>
To: Sean Turner <[email-masked]>, "[email-masked]" <[email-masked]>
Date: Wed, 15 Jun 2011 11:07:10 +1000
Accept-Language: en-US, en-AU
acceptlanguage: en-US, en-AU
Subject: Re: [woes] WOES Charter Proposal

Sean,

I would make almost the opposite edits to the charter than you.
I think it is really helpful that the charter lists different existing prop=
osals (JWT, SWT, MagicSigs, JSS, JSMS). They provides a great context for t=
he WG; they show different approaches; they show people want something in t=
his space.
I think most of the JSON background can be dropped.

  >Thanks for kicking this off Hannes.  In Prague, I thought the goal was=20
  >pretty straightforward: JSONize CMS.  To that end I think we can clip=20
  >out some of the references to work already done.  The BOF can decide=20
  >later what draft is the basis for the starting point.

  ...
  <delete>
  > Different proposals for providing these
  > security services have been defined and implemented. Examples are: JSON
  > Web Token [JWT], Simple Web Tokens [SWT], Magic Signatures
  > [MagicSignatures], JSON Simple Sign [JSS], JavaScript Message Security
  > Format [JSMS].
  </delete>

Date: Tue, 14 Jun 2011 19:25:40 +0200
From: "Hannes Tschofenig" <[email-masked]>
To: "Sean Turner" <[email-masked]>,[email-masked]
Subject: Re: [woes] WOES Charter Proposal

--========GMXBoundary43791308072340278875
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 8bit

> 1) A Standards Track document specifying how to apply a digital > signature and a keyed message digest to > JSON encoded data. <question> I want to be clear that when we're talking about digital signatures we're not talking about HMAC-y operations. If you want to include this here then it need to be reflected earlier as something different than digital signatures. </question> I personally like to distinguish the usage of asymmetric from symmetric algorithms. Some people use the term digital signatures for both; I don't. When I use the term digitial signature I am not talking about HMAC-based operations.

--========GMXBoundary43791308072340278875
Content-Type: text/html; charset="utf-8"
Content-Transfer-Encoding: quoted-printable

<span style=3D'font-family:Verdana'><span style=3D'font-size:12px'><div>=20
	<div>=20
		<pre style=3D"white-space: pre-wrap; word-wrap: break-word; font-size:11;=
pre">=20

&gt; 1) A Standards Track document specifying how to apply a digital=20
&gt; signature and a keyed message digest to=20
&gt; JSON encoded data.=20

&lt;question&gt;=20

I want to be clear that when we're talking about digital signatures=20
we're not talking about HMAC-y operations.  If you want to include this=20
here then it need to be reflected earlier as something different than=20
digital signatures.=20

&lt;/question&gt;=20

I personally like to distinguish the usage of asymmetric from symmetric alg=
orithms.=20
Some people use the term digital signatures for both; I don't.=20

When I use the term digitial signature I am not talking about HMAC-based op=
erations.=20
</pre>=20
	</div>=20
</div>=20
</span></span>

--========GMXBoundary43791308072340278875--

Date: Tue, 14 Jun 2011 12:31:07 -0400
From: Sean Turner <[email-masked]>
To: [email-masked]
Subject: Re: [woes] WOES Charter Proposal

Thanks for kicking this off Hannes.  In Prague, I thought the goal was 
pretty straightforward: JSONize CMS.  To that end I think we can clip 
out some of the references to work already done.  The BOF can decide 
later what draft is the basis for the starting point.

Edits as follows - and one embedded question:

On 6/14/11 8:24 AM, Tschofenig, Hannes (NSN - FI/Espoo) wrote:
> Web Object Encryption and Signing (woes)
> ========================================
>
> Background
> ----------
>
> JSON (an acronym for JavaScript Object Notation) is a text format for
> the serialization of structured data. It is derived from the JavaScript
> programming language for representing simple data structures and
> associative arrays, called objects. Despite its relationship to
> JavaScript, it is language-independent, with parsers available for
> almost every programming language.
>
> The JSON format is described in RFC 4627 and builds on two structures:
> * A collection of name/value pairs. In various languages, this is
> realized as an object, record, struct, dictionary, hash table, keyed
> list, or associative array.
>
> * An ordered list of values. In most languages, this is realized as an
> array, vector, list, or sequence.
>
> The JSON format is often used for serializing and transmitting
> structured data over a network connection. It was initially used in the
> Web environment to transmit data between a server and web application,
> serving as an alternative to XML. Now, JSON is being used in various
> other protocols as well.
>
> With the increased usage of JSON in protocols there is now also the
> desire to offer security services, such as encryption, and message
> signing, for JSON encoded data.

<delete>
> Different proposals for providing these
> security services have been defined and implemented. Examples are: JSON
> Web Token [JWT], Simple Web Tokens [SWT], Magic Signatures
> [MagicSignatures], JSON Simple Sign [JSS], JavaScript Message Security
> Format [JSMS].
</delete>

> This working group aims to develop specifications to standardize these
> security services for JSON encoded data to improve interoperability, and

r/these security services/these two security services

> to increase confidence in the offered security functionality based on
> the expert review process utilized in the IETF.

<delete>
> Future work in the group
> may offer support for other security services. Re-chartering of the
> group is, however, required.
>
> This working group aims to re-use well-defined concepts from
> Cryptographic Message Syntax
> (CMS) [CMS], XML Digital Signature [XMLDSIG] and XML Encryption [XMLENC]
> since the group aims to develop a JavaScript-developer-friendly
> JSON-equivalent for CMS.
>
> Since this work is within the realm of the security domain respective
> experts will be involved.
>
> References
> ----------
>
> [JWT] M. Jones, et al. "JSON Web Signature (JWS)",
> draft-jones-json-web-signature-01 (work in progress), Mar. 2011.
>
> [JSS] Bradley, J. and N. Sakimura (editor), "JSON Simple Sign",
> September 2010.
>
> [MagicSignatures] Panzer (editor), J., Laurie, B., and D. Balfanz,
> "Magic Signatures", August 2010.
>
> [SWT] Hardt, D. and Y. Goland, "Simple Web Token (SWT)", Version
> 0.9.5.1, November 2009.
>
> XMLDIG] W3C, "XML Signature Syntax and Processing (Second Edition)",
> available at
> _http://www.w3.org/TR/xmldsig-core/_, Jun. 2008.
>
> [XMLENC] W3C, "XML Encryption Syntax and Processing", available at
> _http://www.w3.org/TR/xmlenc-core/_, Dec. 2002.
>
> [CMS] R. Housley, "Cryptographic Message Syntax", RFC 3852, Jul. 2004.
>
> [JSMS] E. Rescorla, J. Hildebrand, "JavaScript Message Security Format",
> draft-rescorla-jsms-00 (work in progress), Mar. 2011.

</delete>

<insert>

This working group will base its work on the Cryptographic Message 
Syntax (CMS).

Anything other work items beyond the two listed below are out of scope 
and will require a recharter.

</insert>

> Deliverables
> ------------
>
> This group is chartered to work on two documents:
>
> 1) A Standards Track document specifying how to apply a digital
> signature and a keyed message digest to
> JSON encoded data.

<question>

I want to be clear that when we're talking about digital signatures 
we're not talking about HMAC-y operations.  If you want to include this 
here then it need to be reflected earlier as something different than 
digital signatures.

</question>

> 2) A Standards Track document illustrating how to encrypt JSON encoded
> data.
>
> Goals and Milestones
> --------------------
>
> Aug 2011 Submit JSON object signing document as a WG item.
>
> Aug 2011 Submit JSON object encryption document as a WG item.
>
> Mar 2012 Start Working Group Last Call on JSON object signing document.
>
> Mar 2012 Start Working Group Last Call on JSON object encryption document.
>
> Apr 2012 Submit JSON object signing document to IESG for consideration as
> Standards Track document.
>
> Apr 2012 Submit JSON object encryption document to IESG for consideration
> as Standards Track document.
>
>
>
>
>
> _______________________________________________
> woes mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/woes

Content-class: urn:content-classes:message
Date: Tue, 14 Jun 2011 15:24:53 +0300
From: "Tschofenig, Hannes (NSN - FI/Espoo)" <[email-masked]>
To: <[email-masked]>
Subject: [woes] WOES Charter Proposal

This is a multi-part message in MIME format.

------_=_NextPart_001_01CC2A8D.6921B153
Content-Type: text/plain;
	charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

Web Object Encryption and Signing (woes)
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

Background
----------

JSON (an acronym for JavaScript Object Notation) is a text format for
the serialization of structured data. It is derived from the JavaScript
programming language for representing simple data structures and
associative arrays, called objects. Despite its relationship to
JavaScript, it is language-independent, with parsers available for
almost every programming
language.

The JSON format is described in RFC 4627 and builds on two structures:
* A collection of name/value pairs. In various languages, this is
realized as an object, record, struct, dictionary, hash table, keyed
list, or associative array.
* An ordered list of values. In most languages, this is realized as an
array, vector, list, or sequence.

The JSON format is often used for serializing and transmitting
structured data over a network connection. It was initially used in the
Web environment to transmit data between a server and web application,
serving as an alternative to XML. Now, JSON is being used in various
other protocols as well.

With the increased usage of JSON in protocols there is now also the
desire to offer security services, such as encryption, and message
signing, for JSON encoded data. Different proposals for providing these
security services have been defined and implemented.  Examples are: JSON
Web Token [JWT], Simple Web Tokens [SWT], Magic Signatures
[MagicSignatures], JSON Simple Sign [JSS], JavaScript Message Security
Format [JSMS].=20

This working group aims to develop specifications to standardize these
security services for JSON encoded data to improve interoperability, and
to increase confidence in the offered security functionality based on
the expert review process utilized in the IETF. Future work in the group
may offer support for other security services. Re-chartering of the
group is, however, required.

This working group aims to re-use well-defined concepts from
Cryptographic Message Syntax
(CMS) [CMS], XML Digital Signature [XMLDSIG] and XML Encryption [XMLENC]
since the group aims to develop a JavaScript-developer-friendly
JSON-equivalent for CMS.=20

Since this work is within the realm of the security domain respective
experts will be involved.=20

References
----------

[JWT] M. Jones, et al. "JSON Web Signature (JWS)",
draft-jones-json-web-signature-01 (work in progress), Mar. 2011.

[JSS] Bradley, J. and N. Sakimura (editor), "JSON Simple Sign",
September 2010.

[MagicSignatures] Panzer (editor), J., Laurie, B., and D. Balfanz,
"Magic Signatures", August 2010.

[SWT] Hardt, D. and Y. Goland, "Simple Web Token (SWT)", Version
0.9.5.1, November 2009.

XMLDIG] W3C, "XML Signature Syntax and Processing (Second Edition)",
available at
http://www.w3.org/TR/xmldsig-core/, Jun. 2008.=20

[XMLENC] W3C, "XML Encryption Syntax and Processing", available at
http://www.w3.org/TR/xmlenc-core/, Dec. 2002.

[CMS]  R. Housley, "Cryptographic Message Syntax", RFC 3852, Jul. 2004.=20

[JSMS] E. Rescorla, J. Hildebrand, "JavaScript Message Security Format",
draft-rescorla-jsms-00 (work in progress), Mar. 2011.

Deliverables
------------

This group is chartered to work on two documents:=20

1) A Standards Track document specifying how to apply a digital
signature and a keyed message digest to=20
JSON encoded data.

2) A Standards Track document illustrating how to encrypt JSON encoded
data.=20

Goals and Milestones
--------------------

Aug 2011    Submit JSON object signing document as a WG item.

Aug 2011    Submit JSON object encryption document as a WG item.

Mar 2012    Start Working Group Last Call on JSON object signing
document.

Mar 2012    Start Working Group Last Call on JSON object encryption
document.

Apr 2012    Submit JSON object signing document to IESG for
consideration as
Standards Track document.

Apr 2012    Submit JSON object encryption document to IESG for
consideration
as Standards Track document.

------_=_NextPart_001_01CC2A8D.6921B153
Content-Type: text/html;
	charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; =
charset=3Dus-ascii">
<META NAME=3D"Generator" CONTENT=3D"MS Exchange Server version =
6.5.7654.12">
<TITLE>WOES Charter Proposal</TITLE>
</HEAD>
<BODY>
<!-- Converted from text/rtf format -->

<P><SPAN LANG=3D"en-gb"><FONT SIZE=3D2 FACE=3D"Courier New">Web Object =
Encryption and Signing (woes)</FONT></SPAN>

<BR><SPAN LANG=3D"en-us"><FONT SIZE=3D2 FACE=3D"Courier =
New">=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D</FONT></SPAN>
</P>

<P><SPAN LANG=3D"en-us"><FONT SIZE=3D2 FACE=3D"Courier =
New">Background</FONT></SPAN>

<BR><SPAN LANG=3D"en-us"><FONT SIZE=3D2 FACE=3D"Courier =
New">----------</FONT></SPAN>
</P>

<P><SPAN LANG=3D"en-us"><FONT SIZE=3D2 FACE=3D"Courier New">JSON (an =
acronym for JavaScript Object Notation) is a text format for the =
serialization of structured data. It is derived from the JavaScript =
programming language for representing simple data structures and =
associative arrays, called objects. Despite its relationship to =
JavaScript, it is language-independent, with parsers available for =
almost every programming</FONT></SPAN></P>

<P><SPAN LANG=3D"en-us"><FONT SIZE=3D2 FACE=3D"Courier =
New">language.</FONT></SPAN>
</P>

<P><SPAN LANG=3D"en-us"><FONT SIZE=3D2 FACE=3D"Courier New">The JSON =
format is described in RFC 4627 and builds on two =
structures:</FONT></SPAN>

<BR><SPAN LANG=3D"en-us"><FONT SIZE=3D2 FACE=3D"Courier New">* A =
collection of name/value pairs. In various languages, this is realized =
as an object, record, struct, dictionary, hash table, keyed list, or =
associative array.</FONT></SPAN></P>

<P><SPAN LANG=3D"en-us"><FONT SIZE=3D2 FACE=3D"Courier New">* An ordered =
list of values. In most languages, this is realized as an array, vector, =
list, or sequence.</FONT></SPAN>
</P>

<P><SPAN LANG=3D"en-us"><FONT SIZE=3D2 FACE=3D"Courier New">The JSON =
format is often used for serializing and transmitting structured data =
over a network connection. It was initially used in the Web environment =
to transmit data between a server and web application, serving as an =
alternative to XML. Now, JSON is being used in various other protocols =
as well.</FONT></SPAN></P>

<P><SPAN LANG=3D"en-us"><FONT SIZE=3D2 FACE=3D"Courier New">With the =
increased usage of JSON in protocols there is now also the desire to =
offer security services, such as encryption, and message signing, for =
JSON encoded data. Different proposals for providing these security =
services have been defined and implemented.&nbsp; Examples are: JSON Web =
Token [JWT], Simple Web Tokens [SWT], Magic Signatures =
[MagicSignatures], JSON Simple Sign [JSS], JavaScript Message Security =
Format [JSMS]. </FONT></SPAN></P>

<P><SPAN LANG=3D"en-us"><FONT SIZE=3D2 FACE=3D"Courier New">This working =
group aims to develop specifications to standardize these security =
services for JSON encoded data to improve interoperability, and to =
increase confidence in the offered security functionality based on the =
expert review process utilized in the IETF.</FONT></SPAN><SPAN =
LANG=3D"fi"><FONT SIZE=3D2 FACE=3D"Courier New"></FONT></SPAN><SPAN =
LANG=3D"en-us"> <FONT SIZE=3D2 FACE=3D"Courier New">Future work in the =
group may offer support for other security services. Re-chartering of =
the group is, however, required.</FONT></SPAN></P>

<P><SPAN LANG=3D"en-us"><FONT SIZE=3D2 FACE=3D"Courier New">This working =
group aims to re-use well-defined concepts from Cryptographic Message =
Syntax</FONT></SPAN>

<BR><SPAN LANG=3D"en-us"><FONT SIZE=3D2 FACE=3D"Courier New">(CMS) =
[CMS], XML Digital Signature [XMLDSIG] and XML Encryption [XMLENC] =
since</FONT></SPAN><SPAN LANG=3D"fi"> <FONT SIZE=3D2 FACE=3D"Courier =
New">the group aims to develop a JavaScript-developer-friendly =
JSON-equivalent for CMS.</FONT></SPAN><SPAN LANG=3D"en-us"><FONT =
SIZE=3D2 FACE=3D"Courier New"> </FONT></SPAN></P>

<P><SPAN LANG=3D"en-us"><FONT SIZE=3D2 FACE=3D"Courier New">Since this =
work is within the realm of the security domain respective experts will =
be involved. </FONT></SPAN>
</P>

<P><SPAN LANG=3D"en-us"><FONT SIZE=3D2 FACE=3D"Courier =
New">References</FONT></SPAN>

<BR><SPAN LANG=3D"en-us"><FONT SIZE=3D2 FACE=3D"Courier =
New">----------</FONT></SPAN>
</P>

<P><SPAN LANG=3D"en-us"><FONT SIZE=3D2 FACE=3D"Courier New">[JWT] M. =
Jones, et al. &quot;JSON Web Signature (JWS)&quot;,&nbsp; =
draft-jones-json-web-signature-01 (work in progress), Mar. =
2011.</FONT></SPAN>
</P>

<P><SPAN LANG=3D"en-us"><FONT SIZE=3D2 FACE=3D"Courier New">[JSS] =
Bradley, J. and N. Sakimura (editor), &quot;JSON Simple Sign&quot;, =
September 2010.</FONT></SPAN>
</P>

<P><SPAN LANG=3D"en-us"><FONT SIZE=3D2 FACE=3D"Courier =
New">[MagicSignatures] Panzer (editor), J., Laurie, B., and D. Balfanz, =
&quot;Magic Signatures&quot;, August 2010.</FONT></SPAN>
</P>

<P><SPAN LANG=3D"en-us"><FONT SIZE=3D2 FACE=3D"Courier New">[SWT] Hardt, =
D. and Y. Goland, &quot;Simple Web Token (SWT)&quot;, Version 0.9.5.1, =
November 2009.</FONT></SPAN>
</P>

<P><SPAN LANG=3D"en-us"><FONT SIZE=3D2 FACE=3D"Courier New">XMLDIG] W3C, =
&quot;XML Signature Syntax and Processing (Second Edition)&quot;, =
available at</FONT></SPAN>

<BR><SPAN LANG=3D"es"></SPAN><A =
HREF=3D"http://www.w3.org/TR/xmldsig-core/"><SPAN LANG=3D"es"><U><FONT =
COLOR=3D"#0000FF" SIZE=3D2 FACE=3D"Courier =
New">http://www.w3.org/TR/xmldsig-core/</FONT></U></SPAN><SPAN =
LANG=3D"es"></SPAN></A><SPAN LANG=3D"es"></SPAN><SPAN =
LANG=3D"en-us"></SPAN><SPAN LANG=3D"es"><FONT SIZE=3D2 FACE=3D"Courier =
New">, Jun. 2008. </FONT></SPAN>
</P>

<P><SPAN LANG=3D"en-gb"><FONT SIZE=3D2 FACE=3D"Courier New">[XMLENC] =
W3C, &quot;XML Encryption Syntax and Processing&quot;, available =
at</FONT></SPAN>

<BR><SPAN LANG=3D"en-us"></SPAN><A =
HREF=3D"http://www.w3.org/TR/xmlenc-core/"><SPAN LANG=3D"en-us"><U><FONT =
COLOR=3D"#0000FF" SIZE=3D2 FACE=3D"Courier =
New">http://www.w3.org/TR/xmlenc-core/</FONT></U></SPAN><SPAN =
LANG=3D"en-us"></SPAN></A><SPAN LANG=3D"en-us"></SPAN><SPAN =
LANG=3D"en-gb"></SPAN><SPAN LANG=3D"en-us"><FONT SIZE=3D2 =
FACE=3D"Courier New">, Dec. 2002.</FONT></SPAN>
</P>

<P><SPAN LANG=3D"en-us"><FONT SIZE=3D2 FACE=3D"Courier New">[CMS]&nbsp; =
R. Housley, &quot;Cryptographic Message Syntax&quot;, RFC 3852, Jul. =
2004. </FONT></SPAN>
</P>

<P><SPAN LANG=3D"en-gb"><FONT SIZE=3D2 FACE=3D"Courier New">[JSMS] E. =
Rescorla, J. Hildebrand, &quot;JavaScript Message Security Format&quot;, =
draft-rescorla-jsms-00 (work in progress), Mar. 2011.</FONT></SPAN></P>

<P><SPAN LANG=3D"en-us"><FONT SIZE=3D2 FACE=3D"Courier =
New">Deliverables</FONT></SPAN>

<BR><SPAN LANG=3D"en-us"><FONT SIZE=3D2 FACE=3D"Courier =
New">------------</FONT></SPAN>
</P>

<P><SPAN LANG=3D"en-us"><FONT SIZE=3D2 FACE=3D"Courier New">This group =
is chartered to work on two documents: </FONT></SPAN>
</P>

<P><SPAN LANG=3D"en-us"><FONT SIZE=3D2 FACE=3D"Courier New">1) A =
Standards Track document specifying how to apply a digital signature and =
a keyed message digest to </FONT></SPAN>

<BR><SPAN LANG=3D"en-us"><FONT SIZE=3D2 FACE=3D"Courier New">JSON =
encoded data.</FONT></SPAN>
</P>

<P><SPAN LANG=3D"en-us"><FONT SIZE=3D2 FACE=3D"Courier New">2) A =
Standards Track document illustrating how to encrypt JSON encoded data. =
</FONT></SPAN>
</P>

<P><SPAN LANG=3D"en-us"><FONT SIZE=3D2 FACE=3D"Courier New">Goals and =
Milestones</FONT></SPAN>

<BR><SPAN LANG=3D"en-us"><FONT SIZE=3D2 FACE=3D"Courier =
New">--------------------</FONT></SPAN>
</P>

<P><SPAN LANG=3D"en-us"><FONT SIZE=3D2 FACE=3D"Courier New">Aug =
2011&nbsp;&nbsp;&nbsp; Submit JSON object signing document as a WG =
item.</FONT></SPAN>
</P>

<P><SPAN LANG=3D"en-us"><FONT SIZE=3D2 FACE=3D"Courier New">Aug =
2011&nbsp;&nbsp;&nbsp; Submit JSON object encryption document as a WG =
item.</FONT></SPAN>
</P>

<P><SPAN LANG=3D"en-us"><FONT SIZE=3D2 FACE=3D"Courier New">Mar =
2012&nbsp;&nbsp;&nbsp; Start Working Group Last Call on JSON object =
signing document.</FONT></SPAN>
</P>

<P><SPAN LANG=3D"en-us"><FONT SIZE=3D2 FACE=3D"Courier New">Mar =
2012&nbsp;&nbsp;&nbsp; Start Working Group Last Call on JSON object =
encryption document.</FONT></SPAN>
</P>

<P><SPAN LANG=3D"en-us"><FONT SIZE=3D2 FACE=3D"Courier New">Apr =
2012&nbsp;&nbsp;&nbsp; Submit JSON object signing document to IESG for =
consideration as</FONT></SPAN>

<BR><SPAN LANG=3D"en-us"><FONT SIZE=3D2 FACE=3D"Courier New">Standards =
Track document.</FONT></SPAN>
</P>

<P><SPAN LANG=3D"en-us"><FONT SIZE=3D2 FACE=3D"Courier New">Apr =
2012&nbsp;&nbsp;&nbsp; Submit JSON object encryption document to IESG =
for consideration</FONT></SPAN>

<BR><SPAN LANG=3D"en-us"><FONT SIZE=3D2 FACE=3D"Courier New">as =
Standards Track document.</FONT></SPAN>
</P>
<BR>
<BR>

</BODY>
</HTML>
------_=_NextPart_001_01CC2A8D.6921B153--