Subject: Re: [jose] #12: x5c incorrect in JWE

From: "Manger, James H" <[email-masked]>
Date: Mon, 1 Apr 2013 21:48:32 +1100

> #12: x5c incorrect in JWE
> 
> 
> Comment (by [email-masked]):
> 
>  For generality, I'll note that if people believe that "x5c" should be
> removed from JWE, then the same logic probably suggests that "x5u",
> "jku"
>  should be removed, as all are ways of including or referencing public
> key  values corresponding to the private key used to encrypt the
> content.  And  by that logic, if we don't need a way to reference or
> include public key  values for JWEs, then the "x5t" and possibly "kid"
> parameters would then  also be of dubious value.  At least by that
> reasoning, the inclusion of  all the key reference parameters would
> likely stand or fall together.

Yay! Drop the lot ("jku", "jwk", "x5u", "x5t", "x5c") from JWE; keep "kid".

Should we describe how to get a "kid" value from a certificate or a raw public key (in case an explicit "kid" value is not available to a JWE originator)? If you only have a cert you can look for a subjectKeyIdentifier extension -- though that is an OCTET STRING so it may need to be base64url-encoded (without padding) to give a "kid" string. A raw public key could be hashed to synthetise a "kid" value, but then you need a canonical form of the public key to hash.

--
James Manger

---

From: Richard Barnes <[email-masked]>
Date: Wed, 3 Apr 2013 23:36:39 -0400

I don't have much feeling one way or another, especially since header
fields are non-critical now.
--Richard

On Mon, Apr 1, 2013 at 6:48 AM, Manger, James H <
[email-masked]> wrote:

> Should we describe how to get a "kid" value from a certificate or a raw
> public key (in case an explicit "kid" value is not available to a JWE
> originator)? If you only have a cert you can look for a
> subjectKeyIdentifier extension -- though that is an OCTET STRING so it may
> need to be base64url-encoded (without padding) to give a "kid" string. A
> raw public key could be hashed to synthetise a "kid" value, but then you
> need a canonical form of the public key to hash.
>
> --
> James Manger
> _______________________________________________
> jose mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/jose
>

---

From: "jose issue tracker" <[email-masked]>
Date: Wed, 24 Apr 2013 18:44:49 -0000

draft-ietf-jose-json-web-encryption-09 now uniformly uses the language
 "the key to which the JWE was encrypted" when describing the key - not
 just for "x5c" but for all the key specification parameters.  This is now
 both correct and clear.  Therefore, I believe that this issue should be
 closed.

-- 
-------------------------------------+-------------------------------------
 Reporter:                           |       Owner:  draft-ietf-jose-json-
  [email-masked]         |  [email-masked]
     Type:  defect                   |      Status:  new
 Priority:  minor                    |   Milestone:
Component:  json-web-encryption      |     Version:
 Severity:  Submitted WG Document    |  Resolution:
 Keywords:                           |
-------------------------------------+-------------------------------------

Ticket URL: <http://trac.tools.ietf.org/wg/jose/trac/ticket/12#comment:4>
jose <http://tools.ietf.org/jose/>

---

From: Richard Barnes <[email-masked]>
Date: Wed, 24 Apr 2013 18:17:49 -0400

I don't object to closing this.  I don't really think that "x5c" is that
useful, but at least it's properly specified now.

---

From: John Bradley <[email-masked]>
Date: Wed, 24 Apr 2013 19:49:48 -0300

Agreed

On 2013-04-24, at 7:17 PM, Richard Barnes <[email-masked]> wrote:

> I don't object to closing this.  I don't really think that "x5c" is that useful, but at least it's properly specified now.
> 
> 
> On Wed, Apr 24, 2013 at 2:44 PM, jose issue tracker <[email-masked]> wrote:

---

From: "jose issue tracker" <[email-masked]>
Date: Tue, 30 Apr 2013 17:41:56 -0000

Changes (by [email-masked]):

 * status:  new => closed
 * resolution:   => fixed

-- 
-------------------------------------+-------------------------------------
 Reporter:                           |       Owner:  draft-ietf-jose-json-
  [email-masked]         |  [email-masked]
     Type:  defect                   |      Status:  closed
 Priority:  minor                    |   Milestone:
Component:  json-web-encryption      |     Version:
 Severity:  Submitted WG Document    |  Resolution:  fixed
 Keywords:                           |
-------------------------------------+-------------------------------------

Ticket URL: <http://trac.tools.ietf.org/wg/jose/trac/ticket/12#comment:6>
jose <http://tools.ietf.org/jose/>