Subject: [jose] Feedback request on jose tracker issue #15: Should at least on key indicator be mandatory

From: Karen O'Donoghue <[email-masked]>
Date: Thu, 11 Apr 2013 19:59:31 -0400

Issue #15 http://trac.tools.ietf.org/wg/jose/trac/ticket/15 
<http://trac.tools.ietf.org/wg/jose/trac/ticket/15>. suggests requiring 
that a key indicator, such as a "kid" field, be required in all JWS and 
JWE headers.Are use cases where key information is exchanged by means 
other than the JWS or JWE headers important?

Which of these best describes your preferences on this issue?

1.  Yes.

2. No.

0.  I need more information to decide.

Your reply is requested by Friday, April 19^th (or earlier).

---

From: Dick Hardt <[email-masked]>
Date: Thu, 11 Apr 2013 17:22:11 -0700

1A,  a key indicator SHOULD be included. (not a MUST)

On Apr 11, 2013, at 4:59 PM, Karen O'Donoghue <[email-masked]> wrote:

> Issue #15 http://trac.tools.ietf.org/wg/jose/trac/ticket/15. suggests requiring that a key indicator, such as a “kid” field, be required in all JWS and JWE headers. Are use cases where key information is exchanged by means other than the JWS or JWE headers important?
> Your reply is requested by Friday, April 19th (or earlier). 
> _______________________________________________
> jose mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/jose

---

From: "Manger, James H" <[email-masked]>
Date: Fri, 12 Apr 2013 12:54:44 +1000

1A. A key indication SHOULD be included (and certainly must be present in all the examples in the spec).

P.S. Does “Yes” mean “Yes, a key indicator is required”, or does it mean “Yes, use cases where key information is exchanged by means other than the JWS or JWE headers are important” (which implies a key indicator is NOT required)?

--
James Manger

From: [email-masked] [mailto:[email-masked]] On Behalf Of Karen O'Donoghue
Sent: Friday, 12 April 2013 10:00 AM
To: [email-masked]
Subject: [jose] Feedback request on jose tracker issue #15: Should at least on key indicator be mandatory

---

From: Mike Jones <[email-masked]>
Date: Fri, 12 Apr 2013 05:25:03 +0000

Reading this question, I believe that there's a possibility for the question to be misinterpreted, since the sense of the question in the subject is opposite of the sense of the question in the body.  I believe that the intent of 1 and 2 were as follows:

1.  Yes - Use cases where key information is exchanged by means other than the JWS and JWE headers ARE important.
2.  No - Use cases where key information is exchanged by means other than the JWS and JWE headers ARE NOT important.

Maybe people could reply with 1 and 2 as above, so that their answers to the question of whether these use cases are important are not are unambiguous.

                                                            -- Mike

From: [email-masked] [mailto:[email-masked]] On Behalf Of Karen O'Donoghue
Sent: Thursday, April 11, 2013 5:00 PM
To: [email-masked]
Subject: [jose] Feedback request on jose tracker issue #15: Should at least on key indicator be mandatory

Issue #15 http://trac.tools.ietf.org/wg/jose/trac/ticket/15. suggests requiring that a key indicator, such as a "kid" field, be required in all JWS and JWE headers. Are use cases where key information is exchanged by means other than the JWS or JWE headers important?
Which of these best describes your preferences on this issue?
1.  Yes.
2.   No.
0.  I need more information to decide.

---

From: <[email-masked]>
Date: Fri, 12 Apr 2013 08:23:36 +0200

Please reissue this question. This is ambiguous.

1A: A key indicator SHOULD  be included but can be omitted because use cases where key information is exchanged by means other than the JWS or JWE headers are important.

From: [email-masked] [mailto:[email-masked]] On Behalf Of Karen O'Donoghue
Sent: Friday, April 12, 2013 2:00 AM
To: [email-masked]
Subject: [jose] Feedback request on jose tracker issue #15: Should at least on key indicator be mandatory

---

From: Roland Hedberg <[email-masked]>
Date: Sun, 14 Apr 2013 10:33:13 +0200

I support 1 as defined by Mike.

12 apr 2013 kl. 07:25 skrev Mike Jones <[email-masked]>:

> 1.  Yes – Use cases where key information is exchanged by means other than the JWS and JWE headers ARE important

-- Roland

---

From: hideki nara <[email-masked]>
Date: Mon, 15 Apr 2013 16:02:10 +0900

1

2013/4/12 Karen O'Donoghue <[email-masked]>

>  Issue #15 http://trac.tools.ietf.org/wg/jose/trac/ticket/15. suggests
> requiring that a key indicator, such as a “kid” field, be required in all
> JWS and JWE headers.****** Are use cases where key information is
> exchanged by means other than the JWS or JWE headers important?**
>
> Which of these best describes your preferences on this issue?****
>
> 1.  Yes.****
>
> 2.   No. ****
>
> 0.  I need more information to decide.****
>
> ** **

---

From: Mike Jones <[email-masked]>
Date: Mon, 15 Apr 2013 15:24:41 +0000

-----Original Message-----
From: Roland Hedberg [mailto:[email-masked]] 
Sent: Sunday, April 14, 2013 1:33 AM
To: [email-masked]
Cc: [email-masked]; Mike Jones
Subject: Re: [jose] Feedback request on jose tracker issue #15: Should at least on key indicator be mandatory

12 apr 2013 kl. 07:25 skrev Mike Jones <[email-masked]>:

> 1.  Yes - Use cases where key information is exchanged by means other than the JWS and JWE headers ARE important

-- Roland

From: Mike Jones 
Sent: Thursday, April 11, 2013 10:25 PM
To: [email-masked]'; [email-masked]
Subject: RE: [jose] Feedback request on jose tracker issue #15: Should at least on key indicator be mandatory

                                                            -- Mike

---

From: Richard Barnes <[email-masked]>
Date: Mon, 15 Apr 2013 11:34:31 -0400

If including a key indicator is not a MUST, then you have to specify what
the receiver does when a key indicator is not present.  Could you suggest
text for that?

Thanks,
--Richard

On Thu, Apr 11, 2013 at 8:22 PM, Dick Hardt <[email-masked]> wrote:

> JWS and JWE headers.**** Are use cases where key information is exchanged
> by means other than the JWS or JWE headers important?
>

---

From: Richard Barnes <[email-masked]>
Date: Mon, 15 Apr 2013 11:40:42 -0400

Nice straw man, Mike  :)

Nobody is arguing that cases with out-of-band negotiation are not
important.  The question is how they should be supported.

What ISSUE-9 and ISSUE-15 are about is saying that the default assumption
should be that all communication is via JW* headers.  Otherwise, we're not
designing a stand-alone protocol, we're designing an adjunct to something
else, and we should do it in that WG.  That default assumption means that
you have to have certain contraints, like a key indicator being REQUIRED.
 The SPI header is then the "get out of jail free card", releasing you from
those constraints.

Let's design a real protocol first, then let people cheat.

--Richard

On Fri, Apr 12, 2013 at 1:25 AM, Mike Jones <[email-masked]>wrote:

>  Reading this question, I believe that there’s a possibility for the
> question to be misinterpreted, since the sense of the question in the
> subject is opposite of the sense of the question in the body.  I believe
> that the intent of 1 and 2 were as follows:****
>
> ** **
>
> 1.  Yes – Use cases where key information is exchanged by means other than
> the JWS and JWE headers ARE important.****
>
> 2.  No – Use cases where key information is exchanged by means other than
> the JWS and JWE headers ARE NOT important.****
>
> ** **
>
> Maybe people could reply with 1 and 2 as above, so that their answers to
> the question of whether these use cases are important are not are
> unambiguous.****
>
> ** **
>
>                                                             -- Mike****
>
> ** **
>
> *From:* [email-masked] [mailto:[email-masked]] *On Behalf
> Of *Karen O'Donoghue
> *Sent:* Thursday, April 11, 2013 5:00 PM
>
> *To:* [email-masked]
> *Subject:* [jose] Feedback request on jose tracker issue #15: Should at
> least on key indicator be mandatory****
>
>  ** **
>
> JWS and JWE headers. Are use cases where key information is exchanged by
> means other than the JWS or JWE headers important? ****
>
>  ****
> Your reply is requested by Friday, April 19th (or earlier). ****
>

---

From: Mike Jones <[email-masked]>
Date: Mon, 15 Apr 2013 15:45:01 +0000

You could say "nice straw man, Jim", as it was Jim Schaad who proposed that the right question to ask was whether such use cases are important or not.  I agree with Jim that clearly if they are important/in scope, then key indicators in the headers can't be mandatory.

                                                            -- Mike

From: Richard Barnes [mailto:[email-masked]]
Sent: Monday, April 15, 2013 8:41 AM
To: Mike Jones
Cc: [email-masked]; [email-masked]
Subject: Re: [jose] Feedback request on jose tracker issue #15: Should at least on key indicator be mandatory

Nice straw man, Mike  :)

Nobody is arguing that cases with out-of-band negotiation are not important.  The question is how they should be supported.

What ISSUE-9 and ISSUE-15 are about is saying that the default assumption should be that all communication is via JW* headers.  Otherwise, we're not designing a stand-alone protocol, we're designing an adjunct to something else, and we should do it in that WG.  That default assumption means that you have to have certain contraints, like a key indicator being REQUIRED.  The SPI header is then the "get out of jail free card", releasing you from those constraints.

--Richard

On Fri, Apr 12, 2013 at 1:25 AM, Mike Jones <[email-masked]<mailto:[email-masked]>> wrote:
Reading this question, I believe that there's a possibility for the question to be misinterpreted, since the sense of the question in the subject is opposite of the sense of the question in the body.  I believe that the intent of 1 and 2 were as follows:

                                                            -- Mike

From: [email-masked]<mailto:[email-masked]> [mailto:[email-masked]<mailto:[email-masked]>] On Behalf Of Karen O'Donoghue
Sent: Thursday, April 11, 2013 5:00 PM

To: [email-masked]<mailto:[email-masked]>
Subject: [jose] Feedback request on jose tracker issue #15: Should at least on key indicator be mandatory

_______________________________________________
jose mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/jose

---

From: nov matake <[email-masked]>
Date: Tue, 16 Apr 2013 01:03:39 +0900

1

nov

---

From: Anthony Nadalin <[email-masked]>
Date: Mon, 15 Apr 2013 16:45:18 +0000

-----Original Message-----
From: Roland Hedberg [mailto:[email-masked]] 
Sent: Sunday, April 14, 2013 1:33 AM
To: [email-masked]
Cc: [email-masked]; Mike Jones
Subject: Re: [jose] Feedback request on jose tracker issue #15: Should at least on key indicator be mandatory

-- Roland

From: Mike Jones 

                                                            -- Mike

---

From: Matias Woloski <[email-masked]>
Date: Mon, 15 Apr 2013 14:12:05 -0300

1.  Yes - Use cases where key information is exchanged by means other than
the JWS and JWE headers ARE important.

On Mon, Apr 15, 2013 at 1:45 PM, Anthony Nadalin <[email-masked]>wrote:

> > 1.  Yes - Use cases where key information is exchanged by means other
> than the JWS and JWE headers ARE important
>
> -- Roland
>
> From: Mike Jones
> Reading this question, I believe that there's a possibility for the
> that the intent of 1 and 2 were as follows:
>
> 2.  No - Use cases where key information is exchanged by means other than
> the JWS and JWE headers ARE NOT important.
>
> unambiguous.
> requiring that a key indicator, such as a "kid" field, be required in all
> means other than the JWS or JWE headers important?

---

From: Breno de Medeiros <[email-masked]>
Date: Mon, 15 Apr 2013 10:16:05 -0700

1. Use cases where key information is exchanged by means other than
the JWS and JWE headers ARE important

-- 
--Breno

---

From: Richard Barnes <[email-masked]>
Date: Mon, 15 Apr 2013 13:31:19 -0400

You're making the same false argument I just addressed.  Covering use cases
involving pre-negotiation does not imply that headers can't be mandatory.
 It implies that they can't be mandatory in all cases -- that is, that
there needs to be a "pre-negotiated mode" in which headers are not
mandatory in addition to the "stand-alone mode" where everything needs to
be expressed in the headers (no pre-negotiation).

I am completely fine with supporting both modes, but in order to do that,
it needs to be clear to a recipient which mode is in use.  So we need to:
(1) Choose a default mode,
(2) Have a switch that indicates when the non-default mode is being used,
and
(3) Define generation and processing rules for both modes.

What I'm saying here is that:
(1) The default mode should be "stand-alone"
(2) The switch is SPI
(3) The processing rules for the stand-alone mode should REQUIRE at least
one key indicator

What you're arguing is that there should not be a well-defined stand-alone
mode, effectively that the recipient always does some pre-negotiation in
order to know what fields it needs.  So you're arguing that the following
basic requirements from the use cases document aren't actually requirements:
"""

   o  The JOSE encrypted object format must support object encryption in
      the case where the sender and receiver share a symmetric key.

   o  The JOSE encrypted object format must support object encryption in
      the case where the sender has only a public key for the receiver.

   o  The JOSE signed object format must integrity protection using
      Message Authentication Codes (MACs), for the case where the sender
      and receiver share only a symmetric key.

   o  The JOSE signed object format must integrity protection using
      digital signatures, for the case where the receiver has only a
      public key for the sender.

"""
The implication of all those "only"s is that everything else has to be
defined by the protocol specification, including which fields are mandatory.

--Richard

On Mon, Apr 15, 2013 at 11:45 AM, Mike Jones <[email-masked]>wrote:

>  You could say “nice straw man, Jim”, as it was Jim Schaad who proposed
> that the right question to ask was whether such use cases are important or
> not.  I agree with Jim that clearly if they are important/in scope, then
> key indicators in the headers can’t be mandatory.****
>
> ** **
>
>                                                             -- Mike****
>
> ** **
>
> *From:* Richard Barnes [mailto:[email-masked]]
> *Sent:* Monday, April 15, 2013 8:41 AM
> *To:* Mike Jones
> *Cc:* [email-masked]; [email-masked]
> *Subject:* Re: [jose] Feedback request on jose tracker issue #15: Should
> at least on key indicator be mandatory****
>
> ** **
>
> Nice straw man, Mike  :)  ****
>
> ** **
>
> important.  The question is how they should be supported.****
>
> ** **
>
> those constraints.****
> Let's design a real protocol first, then let people cheat.****
>
> ** **
>
> --Richard****
>
> ** **
>
> ** **
>
> On Fri, Apr 12, 2013 at 1:25 AM, Mike Jones <[email-masked]>
> wrote:****
>
> *Sent:* Thursday, April 11, 2013 5:00 PM****
>
>
> *To:* [email-masked]
> means other than the JWS or JWE headers important? ** **
>
> https://www.ietf.org/mailman/listinfo/jose****
>
> ** **
>

---

From: Mike Jones <[email-masked]>
Date: Mon, 15 Apr 2013 17:47:30 +0000

I'll plan on reviewing the Use Cases document after finishing the current spec updates to the other specs.  If you believe that the use Cases Document as written precludes use cases where keys are exchanged by mechanisms other than the JOSE headers, that's an indication that some use cases are missing from the document.

                                                            Best wishes,
                                                            -- Mike

From: Richard Barnes [mailto:[email-masked]]
Sent: Monday, April 15, 2013 10:31 AM
To: Mike Jones
Cc: [email-masked]; [email-masked]
Subject: Re: [jose] Feedback request on jose tracker issue #15: Should at least on key indicator be mandatory

You're making the same false argument I just addressed.  Covering use cases involving pre-negotiation does not imply that headers can't be mandatory.  It implies that they can't be mandatory in all cases -- that is, that there needs to be a "pre-negotiated mode" in which headers are not mandatory in addition to the "stand-alone mode" where everything needs to be expressed in the headers (no pre-negotiation).

I am completely fine with supporting both modes, but in order to do that, it needs to be clear to a recipient which mode is in use.  So we need to:
(1) Choose a default mode,
(2) Have a switch that indicates when the non-default mode is being used, and
(3) Define generation and processing rules for both modes.

What I'm saying here is that:
(1) The default mode should be "stand-alone"
(2) The switch is SPI
(3) The processing rules for the stand-alone mode should REQUIRE at least one key indicator

What you're arguing is that there should not be a well-defined stand-alone mode, effectively that the recipient always does some pre-negotiation in order to know what fields it needs.  So you're arguing that the following basic requirements from the use cases document aren't actually requirements:
"""

      public key for the sender.
"""
The implication of all those "only"s is that everything else has to be defined by the protocol specification, including which fields are mandatory.

--Richard

On Mon, Apr 15, 2013 at 11:45 AM, Mike Jones <[email-masked]<mailto:[email-masked]>> wrote:
You could say "nice straw man, Jim", as it was Jim Schaad who proposed that the right question to ask was whether such use cases are important or not.  I agree with Jim that clearly if they are important/in scope, then key indicators in the headers can't be mandatory.

                                                            -- Mike

From: Richard Barnes [mailto:[email-masked]<mailto:[email-masked]>]
Sent: Monday, April 15, 2013 8:41 AM
To: Mike Jones
Cc: [email-masked]<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>
Subject: Re: [jose] Feedback request on jose tracker issue #15: Should at least on key indicator be mandatory

Nice straw man, Mike  :)

--Richard

                                                            -- Mike

---

From: Edmund Jay <[email-masked]>
Date: Mon, 15 Apr 2013 11:06:09 -0700 (PDT)

1

________________________________
From: Karen O'Donoghue <[email-masked]>
To: [email-masked]
Sent: Thu, April 11, 2013 4:59:35 PM
Subject: [jose] Feedback request on jose tracker issue #15: Should at least on 
key indicator be mandatory

Issue #15 http://trac.tools.ietf.org/wg/jose/trac/ticket/15. suggests     
requiring that a key indicator, such as a “kid” field, be required     in all 
JWS and JWE headers.Are use cases where key information is exchanged by means 
other         than the JWS or JWE headers important?

---

From: Richard Barnes <[email-masked]>
Date: Mon, 15 Apr 2013 14:20:26 -0400

Let me reiterate!  I don't think pre-negotiated use cases are precluded, I
just think that by default, the protocol should not rely on pre-negotiated
parameters, including what key to use.

--Richard

On Mon, Apr 15, 2013 at 1:47 PM, Mike Jones <[email-masked]>wrote:

>  I’ll plan on reviewing the Use Cases document after finishing the
> current spec updates to the other specs.  If you believe that the use Cases
> Document as written precludes use cases where keys are exchanged by
> mechanisms other than the JOSE headers, that’s an indication that some use
> cases are missing from the document.****
>
> ** **
>
>                                                             Best wishes,**
> **
>
>                                                             -- Mike****
>
> ** **
>
> *Sent:* Monday, April 15, 2013 10:31 AM
>
> *To:* Mike Jones
> You're making the same false argument I just addressed.  Covering use
> cases involving pre-negotiation does not imply that headers can't be
> mandatory.  It implies that they can't be mandatory in all cases -- that
> is, that there needs to be a "pre-negotiated mode" in which headers are not
> be expressed in the headers (no pre-negotiation).****
>
> ** **
>
> it needs to be clear to a recipient which mode is in use.  So we need to:*
> ***
>
> (1) Choose a default mode,****
>
> and****
> (3) Define generation and processing rules for both modes.****
>
> ** **
>
> What I'm saying here is that:****
>
> (1) The default mode should be "stand-alone"****
>
> (2) The switch is SPI****
>
> one key indicator****
> """****
>    o  The JOSE encrypted object format must support object encryption in****
>
>       the case where the sender and receiver share a symmetric key.****
>
> ** **
>
>    o  The JOSE encrypted object format must support object encryption in****
>
>       the case where the sender has only a public key for the receiver.****
>
> ** **
>
>    o  The JOSE signed object format must integrity protection using****
>
>       Message Authentication Codes (MACs), for the case where the sender****
>
>       and receiver share only a symmetric key.****
>
> ** **
>
>    o  The JOSE signed object format must integrity protection using****
>
>       digital signatures, for the case where the receiver has only a****
>
>       public key for the sender.****
>
>  """****
>
> On Mon, Apr 15, 2013 at 11:45 AM, Mike Jones <[email-masked]>
> wrote:****
>

---

From: "[email-masked]" <[email-masked]>
Date: Wed, 17 Apr 2013 14:38:54 +0200

1.Yes, Use cases where key information is exchanged by means other
than JWS and JWE headers are important.

Charles Marais.

Le 12/04/2013 01:59, Karen O'Donoghue a
écrit :

Issue #15
http://trac.tools.ietf.org/wg/jose/trac/ticket/15. suggests
requiring that a key indicator, such as a “kid” field, be required
in all JWS and JWE headers.
Are use cases where key information is exchanged by means
other than the JWS or JWE headers important?

Which of these best
describes your preferences on this issue?

1.  Yes.

2.   No.

0.  I need more
information to decide.

Your reply is requested by Friday, April
19th (or earlier).

--

MARAIS Charles

FT/OLNC/OLPS/ASE/IDEA/UED

Tel : 02.96.05.24.18

[email-masked]

WF004Bis / R&D Lannion / 2, avenue Pierre Marzin / 22307
LANNION Cedex - France

---

From: Sascha Preibisch <[email-masked]>
Date: Wed, 17 Apr 2013 11:01:02 -0500

1

---

From: John Bradley <[email-masked]>
Date: Wed, 17 Apr 2013 17:56:08 -0300

1.  Yes – Use cases where key information is exchanged by means other than the JWS and JWE headers ARE important.

I also think the KID or other method of identifying the key is a SHOULD.  It might be that there is only one key so identifying it is a touch redundant.
We have methods other than kid to identify the key as well.

---

From: Javier Rojas Blum <[email-masked]>
Date: Thu, 18 Apr 2013 23:20:45 -0400

1

Yes, Use cases where key information is exchanged by means other than 
the JWS and JWE headers are important.
Also they should be included in the examples in the spec.

On 04/17/2013 08:38 AM, [email-masked] wrote:
> Le 12/04/2013 01:59, Karen O'Donoghue a écrit :
>> <http://trac.tools.ietf.org/wg/jose/trac/ticket/15>. suggests 
>> requiring that a key indicator, such as a "kid" field, be required in 
>> all JWS and JWE headers.Are use cases where key information is 
>> exchanged by means other than the JWS or JWE headers important?
>>
> *MARAIS Charles*
> *FT/OLNC/OLPS/ASE/IDEA/UED *
> Tel : 02.96.05.24.18
> [email-masked] <mailto:[email-masked]>
> WF004Bis / R&D Lannion / 2, avenue Pierre Marzin / 22307 LANNION Cedex 
> - France
>
>
>
>
>

---

From: Matt Miller <[email-masked]>
Date: Fri, 19 Apr 2013 09:07:28 -0600

I suppose my answer to this poll (either Karen's or Mike's wording) is "Yes".

However, while I do think that key information exchanges outside of the JWE/JWS headers are important, I do think a reference to the resultant key is mandatory.

- m&m

Matt Miller < [email-masked] >
Cisco Systems, Inc.

On Apr 11, 2013, at 5:59 PM, Karen O'Donoghue <[email-masked]> wrote:

> Issue #15 http://trac.tools.ietf.org/wg/jose/trac/ticket/15 <http://trac.tools.ietf.org/wg/jose/trac/ticket/15>. suggests requiring that a key indicator, such as a "kid" field, be required in all JWS and JWE headers.Are use cases where key information is exchanged by means other than the JWS or JWE headers important?
>

---

From: Nat Sakimura <[email-masked]>
Date: Sat, 20 Apr 2013 01:34:16 +0900

1 as it is important to be able to support oob cases.

-- 
Nat Sakimura (=nat)
Chairman, OpenID Foundation
http://nat.sakimura.org/
@_nat_en

---

From: "Salvatore D'Agostino" <[email-masked]>
Date: Fri, 19 Apr 2013 22:42:45 -0400

1, sorry for late replies hectic week here in Boston.

Sal D'Agostino

1.  Yes.

2.   No.