Subject: [jose] Feedback request on jose tracker issue #7: Algorithm identifiers/parameters incompatible with WebCrypto

From: Karen O'Donoghue <[email-masked]>
Date: Thu, 11 Apr 2013 19:58:15 -0400

Issue #7 http://trac.tools.ietf.org/wg/jose/trac/ticket/7 
<http://trac.tools.ietf.org/wg/jose/trac/ticket/7> points out that the 
JWA algorithm identifiers are different than those used by the W3C 
WebCrypto draft at http://www.w3.org/TR/WebCryptoAPI/. The JWA algorithm 
identifiers are strings, whereas the W3C WebCrypto algorithm identifiers 
are structures including string identifiers. The working group had 
previously decided to continue representing JOSE algorithms as strings, 
as recorded at 
http://www.ietf.org/mail-archive/web/jose/current/msg01219.html 
<http://www.ietf.org/mail-archive/web/jose/current/msg01219.html>.

Which of these best describes your preferences on this issue?

1.  Continue have the JWA algorithm identifiers be strings, and not 
objects.  Note that WebCrypto may choose to use some of these same 
strings, where applicable.

2.  Switch to using the algorithm identifier structures defined in the 
WebCrypto draft.

3.  Another resolution (please specify in detail).

0.  I need more information to decide.

Your reply is requested by Friday, April 19^th or earlier.

---

From: Dick Hardt <[email-masked]>
Date: Thu, 11 Apr 2013 17:16:06 -0700

1

On Apr 11, 2013, at 4:58 PM, Karen O'Donoghue <[email-masked]> wrote:

> Issue #7 http://trac.tools.ietf.org/wg/jose/trac/ticket/7 points out that the JWA algorithm identifiers are different than those used by the W3C WebCrypto draft at http://www.w3.org/TR/WebCryptoAPI/.  The JWA algorithm identifiers are strings, whereas the W3C WebCrypto algorithm identifiers are structures including string identifiers.  The working group had previously decided to continue representing JOSE algorithms as strings, as recorded at http://www.ietf.org/mail-archive/web/jose/current/msg01219.html.
> 
> 1.  Continue have the JWA algorithm identifiers be strings, and not objects.  Note that WebCrypto may choose to use some of these same strings, where applicable.
> 
> 2.  Switch to using the algorithm identifier structures defined in the WebCrypto draft.
> 
> Your reply is requested by Friday, April 19th or earlier. 
> 
> 
> 
> 
> _______________________________________________
> jose mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/jose

---

From: <[email-masked]>
Date: Fri, 12 Apr 2013 08:12:31 +0200

1

From: [email-masked] [mailto:[email-masked]] On Behalf Of Dick Hardt
Sent: Friday, April 12, 2013 2:16 AM
To: [email-masked]
Cc: [email-masked]
Subject: Re: [jose] Feedback request on jose tracker issue #7: Algorithm identifiers/parameters incompatible with WebCrypto

1

On Apr 11, 2013, at 4:58 PM, Karen O'Donoghue <[email-masked]<mailto:[email-masked]>> wrote:

_______________________________________________
jose mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/jose

---

From: Roland Hedberg <[email-masked]>
Date: Sat, 13 Apr 2013 21:17:03 +0200

1

---

From: hideki nara <[email-masked]>
Date: Mon, 15 Apr 2013 16:04:47 +0900

1

2013/4/12 Karen O'Donoghue <[email-masked]>

>  Issue #7 http://trac.tools.ietf.org/wg/jose/trac/ticket/7 points out
> that the JWA algorithm identifiers are different than those used by the W3C
> previously decided to continue representing JOSE algorithms as strings, as
> recorded at
> http://www.ietf.org/mail-archive/web/jose/current/msg01219.html.
> ****
>
>
> Which of these best describes your preferences on this issue?****
>
> objects.  Note that WebCrypto may choose to use some of these same strings,
> where applicable.****
>
> WebCrypto draft.****
> 3.  Another resolution (please specify in detail).****
>
> 0.  I need more information to decide.****
>

---

From: Mike Jones <[email-masked]>
Date: Mon, 15 Apr 2013 15:17:22 +0000

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Roland Hedberg
Sent: Saturday, April 13, 2013 12:17 PM
To: [email-masked]
Cc: [email-masked]
Subject: Re: [jose] Feedback request on jose tracker issue #7: Algorithm identifiers/parameters incompatible with WebCrypto

1

---

From: Richard Barnes <[email-masked]>
Date: Mon, 15 Apr 2013 11:41:43 -0400

If people could say why they have certain opinions, that would be helpful.
--Richard

---

From: Richard Barnes <[email-masked]>
Date: Mon, 15 Apr 2013 11:43:13 -0400

2b. Switch to a structure more like the WebCrypto structure, in which
algorithm parameters are collected alongside the algorithm name -- and
separately from key encipherment parameters.

Cf. [draft-barnes-jose-key-wrapping]

---

From: nov matake <[email-masked]>
Date: Tue, 16 Apr 2013 01:05:33 +0900

1

nov

---

From: Anthony Nadalin <[email-masked]>
Date: Mon, 15 Apr 2013 16:44:05 +0000

1

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Roland Hedberg
Sent: Saturday, April 13, 2013 12:17 PM
To: [email-masked]
Cc: [email-masked]
Subject: Re: [jose] Feedback request on jose tracker issue #7: Algorithm identifiers/parameters incompatible with WebCrypto

1

---

From: Matias Woloski <[email-masked]>
Date: Mon, 15 Apr 2013 13:47:57 -0300

1
I like the simplicity of just strings. I like to see a library source code,
and easily find what is supported or not. This is easy to read: "switch
(alg) case "HS256": ..."

On Mon, Apr 15, 2013 at 1:05 PM, nov matake <[email-masked]> wrote:

> where applicable.

---

From: Edmund Jay <[email-masked]>
Date: Mon, 15 Apr 2013 11:03:38 -0700 (PDT)

1

________________________________
From: Karen O'Donoghue <[email-masked]>
To: [email-masked]
Sent: Thu, April 11, 2013 4:58:20 PM
Subject: [jose] Feedback request on jose tracker issue #7: Algorithm 
identifiers/parameters incompatible with WebCrypto

Issue #7 http://trac.tools.ietf.org/wg/jose/trac/ticket/7 points out     that 
the JWA algorithm identifiers are different than those used by     the W3C 
WebCrypto draft at http://www.w3.org/TR/WebCryptoAPI/.       The JWA algorithm 
identifiers are strings, whereas the W3C WebCrypto     algorithm identifiers are 
structures including string identifiers.      The working group had previously 
decided to continue representing     JOSE algorithms as strings, as recorded at 
http://www.ietf.org/mail-archive/web/jose/current/msg01219.html.

---

From: Matt Miller <[email-masked]>
Date: Tue, 16 Apr 2013 09:51:57 -0600

If we're just talking about how the algorithm in use is determined, then I would prefer (1).

While I see value in better separating key encipherment parameters from content encipherment parameters, that seems like a separate question.

- m&m

Matt Miller < [email-masked] >
Cisco Systems, Inc.

>> Your reply is requested by Friday, April 19th or earlier.

- m&m

Matt Miller < [email-masked] >
Cisco Systems, Inc.

---

From: "[email-masked]" <[email-masked]>
Date: Wed, 17 Apr 2013 14:43:06 +0200

Hi,

1.  Continue have the JWA algorithm
identifiers be strings, and not objects.  Note that WebCrypto may
choose to use some of these same strings, where applicable.

Br,

Charles Marais.

Le 12/04/2013 01:58, Karen O'Donoghue a
écrit :

Issue #7
http://trac.tools.ietf.org/wg/jose/trac/ticket/7 points out
that the JWA algorithm identifiers are different than those used
by the W3C WebCrypto draft at http://www.w3.org/TR/WebCryptoAPI/.

The JWA algorithm identifiers are strings, whereas the W3C
WebCrypto algorithm identifiers are structures including string
identifiers.  The working group had previously decided to continue
representing JOSE algorithms as strings, as recorded at
http://www.ietf.org/mail-archive/web/jose/current/msg01219.html.

1.  Continue have
the JWA algorithm identifiers be strings, and not objects.
Note that WebCrypto may choose to use some of these same
strings, where applicable.

2.  Switch to using the algorithm identifier
structures defined in the WebCrypto draft.

3.  Another
resolution (please specify in detail).

0.  I need more
information to decide.

Your reply is
requested by Friday, April 19th or earlier.

--

MARAIS Charles

FT/OLNC/OLPS/ASE/IDEA/UED

Tel : 02.96.05.24.18

[email-masked]

WF004Bis / R&D Lannion / 2, avenue Pierre Marzin / 22307
LANNION Cedex - France

---

From: Sascha Preibisch <[email-masked]>
Date: Wed, 17 Apr 2013 14:02:09 -0500

1.  Continue have the JWA algorithm identifiers be strings, and not objects.

From: [email-masked] [mailto:[email-masked]] On Behalf Of Karen O'Donoghue
Sent: Thursday, April 11, 2013 4:58 PM
To: [email-masked]
Subject: [jose] Feedback request on jose tracker issue #7: Algorithm identifiers/parameters incompatible with WebCrypto

---

From: John Bradley <[email-masked]>
Date: Wed, 17 Apr 2013 16:08:23 -0300

1

While Web crypto may want flexibility on mixing and matching parameters, it is safer to have JOSE users pick from a predefined set defined by a string.
While I understand the flexibility argument,  it also allows encourages people to do potentially unsafe things.

If they need a new combination then they can register a new string and that will at least have some oversight.

John B.

---

From: Javier Rojas Blum <[email-masked]>
Date: Thu, 18 Apr 2013 22:55:09 -0400

1

---

From: Nat Sakimura <[email-masked]>
Date: Fri, 19 Apr 2013 18:15:33 +0900

1 as what we want here is a set of safe presets shorthands.

2013/4/19 Javier Rojas Blum <[email-masked]>:
> While I see value in better separating key encipherment parameters from
> content encipherment parameters, that seems like a separate question.
>
>
> - m&m
>

-- 
Nat Sakimura (=nat)
Chairman, OpenID Foundation
http://nat.sakimura.org/
@_nat_en

---

From: "Salvatore D'Agostino" <[email-masked]>
Date: Fri, 19 Apr 2013 22:38:31 -0400

1

Salvatore D'Agostino, CSCIP
IDmachines LLC |1264 Beacon Street, #5 | Brookline, MA  02446 | USA
http:\\www.idmachines.com | http:\\idmachines.blogspot.com | @idmachines
+1 617.201.4809 ph | +1 617.812.6495 fax

> that the JWA algorithm identifiers are different than those used by
> the W3C WebCrypto draft at http://www.w3.org/TR/WebCryptoAPI/.  The
> JWA algorithm identifiers are strings, whereas the W3C WebCrypto
> algorithm identifiers are structures including string identifiers.
> The working group had previously decided to continue representing JOSE
> algorithms as strings, as recorded at
> strings, where applicable.****
>