Subject: [jose] Feedback request on jose tracker issue #8: Should we add a "spi" header field?

From: Karen O'Donoghue <[email-masked]>
Date: Thu, 11 Apr 2013 19:58:37 -0400

Issue #8 http://trac.tools.ietf.org/wg/jose/trac/ticket/8 
<http://trac.tools.ietf.org/wg/jose/trac/ticket/8> proposes adding an 
"spi" (security parameters index) header parameter to the JWS and JWE 
specifications.  This modification to the JOSE formats would allow for 
signaling that pre-negotiated cryptographic parameters are being used, 
rather than including those parameters in the JWS or JWE header.  This 
proposal has been written up as 
http://tools.ietf.org/html/draft-barnes-jose-spi-00.

Which of these best describes your preferences on this issue?

1.  Have draft-barnes-jose-spi remain a separate specification that 
could optionally also be supported by JWS and JWE implementations.

2.  Incorporate draft-barnes-jose-spi into the JWS and JWE 
specifications as a mandatory feature.

3.  Incorporate draft-barnes-jose-spi into the JWS and JWE 
specifications as an optional feature.

4.  Another resolution (please specify in detail).

0.  I need more information to decide.

Your reply is requested by Friday, April 19^th or earlier.

---

From: Dick Hardt <[email-masked]>
Date: Thu, 11 Apr 2013 17:19:27 -0700

3

On Apr 11, 2013, at 4:58 PM, Karen O'Donoghue <[email-masked]> wrote:

> Issue #8 http://trac.tools.ietf.org/wg/jose/trac/ticket/8 proposes adding an “spi” (security parameters index) header parameter to the JWS and JWE specifications.  This modification to the JOSE formats would allow for signaling that pre-negotiated cryptographic parameters are being used, rather than including those parameters in the JWS or JWE header.  This proposal has been written up as http://tools.ietf.org/html/draft-barnes-jose-spi-00.
>  
> 
> 1.  Have draft-barnes-jose-spi remain a separate specification that could optionally also be supported by JWS and JWE implementations.
> 
> 2.  Incorporate draft-barnes-jose-spi into the JWS and JWE specifications as a mandatory feature.
> 
> 3.  Incorporate draft-barnes-jose-spi into the JWS and JWE specifications as an optional feature.
> 
> Your reply is requested by Friday, April 19th or earlier. 
> _______________________________________________
> jose mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/jose

---

From: "Manger, James H" <[email-masked]>
Date: Fri, 12 Apr 2013 11:53:41 +1000

1b.
Have “spi” as a separate (optional) spec.
Change its definition so it does not change the crypto. For instance, the header that is part of the integrity check is the header with the full alg ids, and key ids — not the header with just the “spi” value. Otherwise “spi” is changing the crypto properties, not just saving bytes.

--
James Manger

From: [email-masked] [mailto:[email-masked]] On Behalf Of Karen O'Donoghue
Sent: Friday, 12 April 2013 9:59 AM
To: [email-masked]
Subject: [jose] Feedback request on jose tracker issue #8: Should we add a "spi" header field?

---

From: <[email-masked]>
Date: Fri, 12 Apr 2013 08:13:44 +0200

1

From: [email-masked] [mailto:[email-masked]] On Behalf Of Dick Hardt
Sent: Friday, April 12, 2013 2:19 AM
To: [email-masked]
Cc: [email-masked]
Subject: Re: [jose] Feedback request on jose tracker issue #8: Should we add a "spi" header field?

3

On Apr 11, 2013, at 4:58 PM, Karen O'Donoghue <[email-masked]<mailto:[email-masked]>> wrote:

Issue #8 http://trac.tools.ietf.org/wg/jose/trac/ticket/8 proposes adding an "spi" (security parameters index) header parameter to the JWS and JWE specifications.  This modification to the JOSE formats would allow for signaling that pre-negotiated cryptographic parameters are being used, rather than including those parameters in the JWS or JWE header.  This proposal has been written up as http://tools.ietf.org/html/draft-barnes-jose-spi-00.

[email-masked]<mailto:[email-masked]>

---

From: Roland Hedberg <[email-masked]>
Date: Sun, 14 Apr 2013 10:34:33 +0200

1

---

From: hideki nara <[email-masked]>
Date: Mon, 15 Apr 2013 16:01:16 +0900

1

2013/4/12 Karen O'Donoghue <[email-masked]>

>  ****Issue #8 http://trac.tools.ietf.org/wg/jose/trac/ticket/8 proposes
> adding an “spi” (security parameters index) header parameter to the JWS and
> JWE specifications.  This modification to the JOSE formats would allow for
> http://tools.ietf.org/html/draft-barnes-jose-spi-00.****
>
> ** **
>
> Which of these best describes your preferences on this issue?****
>
> 1.  Have draft-barnes-jose-spi remain a separate specification that could
> optionally also be supported by JWS and JWE implementations.****
>
> 2.  Incorporate draft-barnes-jose-spi into the JWS and JWE specifications
> as a mandatory feature.****
>
> 3.  Incorporate draft-barnes-jose-spi into the JWS and JWE specifications
> as an optional feature.****
>
> 4.  Another resolution (please specify in detail).****
>
> 0.  I need more information to decide.****

---

From: Mike Jones <[email-masked]>
Date: Mon, 15 Apr 2013 15:18:42 +0000

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Roland Hedberg
Sent: Sunday, April 14, 2013 1:35 AM
To: [email-masked]
Cc: [email-masked]
Subject: Re: [jose] Feedback request on jose tracker issue #8: Should we add a "spi" header field?

1

---

From: nov matake <[email-masked]>
Date: Tue, 16 Apr 2013 00:59:03 +0900

1

nov

---

From: Matias Woloski <[email-masked]>
Date: Mon, 15 Apr 2013 13:36:49 -0300

1

On Mon, Apr 15, 2013 at 12:59 PM, nov matake <[email-masked]> wrote:

> > Issue #8 http://trac.tools.ietf.org/wg/jose/trac/ticket/8 proposes
> adding an "spi" (security parameters index) header parameter to the JWS and

---

From: Anthony Nadalin <[email-masked]>
Date: Mon, 15 Apr 2013 16:44:13 +0000

1

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Roland Hedberg
Sent: Sunday, April 14, 2013 1:35 AM
To: [email-masked]
Cc: [email-masked]
Subject: Re: [jose] Feedback request on jose tracker issue #8: Should we add a "spi" header field?

1

---

From: Richard Barnes <[email-masked]>
Date: Mon, 15 Apr 2013 13:37:11 -0400

2 or 3

All of the "1" responses are missing the point of SPI -- if you want to be
able to omit fields (as people seem to want to do), then you need a switch
to turn off "stand-alone mode".

So responding "1" here is the same as responding "1" on the ISSUE-15 poll,
that at least one key indicator MUST be present.

---

From: Mike Jones <[email-masked]>
Date: Mon, 15 Apr 2013 17:44:37 +0000

Use of "spi" is one such possible "switch".  Use of the OAuth Dynamic Client Registration specification to obtain keys or key references is another.  Other applications may choose exchange the keys other ways.

The "switch" doesn't have to be a JOSE protocol element.  Although you could consider the lack of a key indicator in the JOSE header to be a clear indication in the JOSE protocol elements that the switch has been thrown, meaning that it's up to the application to use its logical to determine which key(s) to use - which is a normal use case.

                                                            -- Mike

From: [email-masked] [mailto:[email-masked]] On Behalf Of Richard Barnes
Sent: Monday, April 15, 2013 10:37 AM
To: [email-masked]
Cc: [email-masked]
Subject: Re: [jose] Feedback request on jose tracker issue #8: Should we add a "spi" header field?

2 or 3

All of the "1" responses are missing the point of SPI -- if you want to be able to omit fields (as people seem to want to do), then you need a switch to turn off "stand-alone mode".

So responding "1" here is the same as responding "1" on the ISSUE-15 poll, that at least one key indicator MUST be present.

On Thu, Apr 11, 2013 at 7:58 PM, Karen O'Donoghue <[email-masked]<mailto:[email-masked]>> wrote:
Issue #8 http://trac.tools.ietf.org/wg/jose/trac/ticket/8 proposes adding an "spi" (security parameters index) header parameter to the JWS and JWE specifications.  This modification to the JOSE formats would allow for signaling that pre-negotiated cryptographic parameters are being used, rather than including those parameters in the JWS or JWE header.  This proposal has been written up as http://tools.ietf.org/html/draft-barnes-jose-spi-00.

---

From: Edmund Jay <[email-masked]>
Date: Mon, 15 Apr 2013 11:04:27 -0700 (PDT)

1

________________________________
From: Karen O'Donoghue <[email-masked]>
To: [email-masked]
Sent: Thu, April 11, 2013 4:58:45 PM
Subject: [jose] Feedback request on jose tracker issue #8: Should we add a "spi" 
header field?

Issue #8 http://trac.tools.ietf.org/wg/jose/trac/ticket/8 proposes     adding an 
“spi” (security parameters index) header parameter to the     JWS and JWE 
specifications.  This modification to the JOSE formats     would allow for 
signaling that pre-negotiated cryptographic     parameters are being used, 
rather than including those parameters in     the JWS or JWE header.  This 
proposal has been written up as 
http://tools.ietf.org/html/draft-barnes-jose-spi-00. 

0.  I need more         information to decide.Your reply is requested by Friday, 
April       19th or earlier.

---

From: Richard Barnes <[email-masked]>
Date: Mon, 15 Apr 2013 14:22:26 -0400

The "switch" does have to be a JOSE protocol element, because the JOSE
protocol logic has to be self-contained.
--Richard

On Mon, Apr 15, 2013 at 1:44 PM, Mike Jones <[email-masked]>wrote:

>  Use of “spi” is one such possible “switch”.  Use of the OAuth Dynamic
> Client Registration specification to obtain keys or key references is
> another.  Other applications may choose exchange the keys other ways.****
>
> ** **
>
> The “switch” doesn’t have to be a JOSE protocol element.  Although you
> could consider the lack of a key indicator in the JOSE header to be a clear
> indication in the JOSE protocol elements that the switch has been thrown,
> meaning that it’s up to the application to use its logical to determine
> which key(s) to use – which is a normal use case.****
>
> ** **
>
>                                                             -- Mike****
>
> ** **
>
> *From:* [email-masked] [mailto:[email-masked]] *On Behalf
> Of *Richard Barnes
> *Sent:* Monday, April 15, 2013 10:37 AM
>
> *To:* [email-masked]
> *Cc:* [email-masked]
> *Subject:* Re: [jose] Feedback request on jose tracker issue #8: Should
> we add a "spi" header field?****
>
> ** **
>
> 2 or 3****
>
> ** **
>
> to turn off "stand-alone mode".  ****
>
> ** **
>
> that at least one key indicator MUST be present.  ****
>
> ** **
>
> ** **
>
> On Thu, Apr 11, 2013 at 7:58 PM, Karen O'Donoghue <[email-masked]>
> wrote:****
>
> Issue #8 http://trac.tools.ietf.org/wg/jose/trac/ticket/8 proposes adding
> an “spi” (security parameters index) header parameter to the JWS and JWE
> http://tools.ietf.org/html/draft-barnes-jose-spi-00. ****
>
>  ****
>
> Your reply is requested by Friday, April 19th or earlier. ****
>
>
> https://www.ietf.org/mailman/listinfo/jose****
>
> ** **
>

---

From: "[email-masked]" <[email-masked]>
Date: Wed, 17 Apr 2013 14:41:47 +0200

Hi,

1.  Have draft-barnes-jose-spi remain a
separate specification that could optionally also be supported by
JWS and JWE implementations.

Br,

Charles Marais.

Le 12/04/2013 01:58, Karen O'Donoghue a
écrit :

Issue #8
http://trac.tools.ietf.org/wg/jose/trac/ticket/8 proposes
adding an “spi” (security parameters index) header parameter to
the JWS and JWE specifications.  This modification to the JOSE
formats would allow for signaling that pre-negotiated
cryptographic parameters are being used, rather than including
those parameters in the JWS or JWE header.  This proposal has been
written up as http://tools.ietf.org/html/draft-barnes-jose-spi-00.

Which of these best
describes your preferences on this issue?

1.  Have
draft-barnes-jose-spi remain a separate specification that
could optionally also be supported by JWS and JWE
implementations.

2.  Incorporate draft-barnes-jose-spi

into the JWS and JWE specifications as a mandatory feature.

3.  Incorporate
draft-barnes-jose-spi into the JWS and JWE specifications as
an optional feature.

4.  Another
resolution (please specify in detail).

0.  I need more
information to decide.

Your reply is requested by Friday, April
19th or earlier.

--

MARAIS Charles

FT/OLNC/OLPS/ASE/IDEA/UED

Tel : 02.96.05.24.18

[email-masked]

WF004Bis / R&D Lannion / 2, avenue Pierre Marzin / 22307
LANNION Cedex - France

---

From: Sascha Preibisch <[email-masked]>
Date: Wed, 17 Apr 2013 14:03:08 -0500

1 - It causes no problems to have spi remain in a separate spec as an optional feature

From: [email-masked] [mailto:[email-masked]] On Behalf Of Karen O'Donoghue
Sent: Thursday, April 11, 2013 4:59 PM
To: [email-masked]
Subject: [jose] Feedback request on jose tracker issue #8: Should we add a "spi" header field?

---

From: John Bradley <[email-masked]>
Date: Wed, 17 Apr 2013 17:43:56 -0300

1

I think this needs more work and time before trying to move it into the base spec.

---

From: Javier Rojas Blum <[email-masked]>
Date: Thu, 18 Apr 2013 23:08:06 -0400

1

On 04/17/2013 08:41 AM, [email-masked] wrote:
> Le 12/04/2013 01:58, Karen O'Donoghue a écrit :
>> specifications.  This modification to the JOSE formats would allow 
>> for signaling that pre-negotiated cryptographic parameters are being 
>> used, rather than including those parameters in the JWS or JWE 
>> header.  This proposal has been written up as 
> *MARAIS Charles*
> *FT/OLNC/OLPS/ASE/IDEA/UED *
> Tel : 02.96.05.24.18
> [email-masked] <mailto:[email-masked]>
> WF004Bis / R&D Lannion / 2, avenue Pierre Marzin / 22307 LANNION Cedex 
> - France
>
>
>
>
>

---

From: "Salvatore D'Agostino" <[email-masked]>
Date: Fri, 19 Apr 2013 22:39:32 -0400

1

Salvatore D'Agostino, CSCIP

IDmachines LLC |1264 Beacon Street, #5 | Brookline, MA  02446 | USA

 <http://www.idmachines.com/> http:\\www.idmachines.com |
<http://idmachines.blogspot.com/> http:\\idmachines.blogspot.com |
@idmachines

+1 617.201.4809 ph | +1 617.812.6495 fax

From: [email-masked] [mailto:[email-masked]] On Behalf Of
Karen O'Donoghue
Sent: Thursday, April 11, 2013 4:59 PM
To: [email-masked]
Subject: [jose] Feedback request on jose tracker issue #8: Should we add a
"spi" header field?

1.  Have draft-barnes-jose-spi remain a separate specification that could
optionally also be supported by JWS and JWE implementations.

2.  Incorporate draft-barnes-jose-spi into the JWS and JWE specifications as
a mandatory feature.

3.  Incorporate draft-barnes-jose-spi into the JWS and JWE specifications as
an optional feature.