Subject: Re: [jose] #15: At least one key indicator should be mandatory

From: "jose issue tracker" <[email-masked]>
Date: Thu, 04 Apr 2013 03:35:18 -0000

#15: At least one key indicator should be mandatory

Comment (by [email-masked]):

 In order for these OAuth JOSE stacks to be interoperable with other JOSE
 stacks, the non-OAuth stacks need to fail cleanly when they get a OAuth
 JOSE object using pre-negotiated parameters.  So objects that use pre-
 negotiated parameters need to signal that they are doing so, using
 something like SPI.  If pre-negotiated parameters are being used, then
 obviously a key indication MUST be present; likewise for algorithms.

 So the specification should say something like: "At least one key
 indication field and one algorithm specification field is REQUIRED.  If an
 SPI value is present, then pre-negotiated parameter values are being used,
 and any field MAY be omitted, even if it would otherwise be REQUIRED."

-- 
-------------------------+-------------------------------------------------
 Reporter:  [email-masked]   |       Owner:  draft-ietf-jose-json-web-
     Type:  defect       |  [email-masked]
 Priority:  minor        |      Status:  new
Component:  json-web-    |   Milestone:
  encryption             |     Version:
 Severity:  -            |  Resolution:
 Keywords:               |
-------------------------+-------------------------------------------------

Ticket URL: <http://trac.tools.ietf.org/wg/jose/trac/ticket/15#comment:6>
jose <http://tools.ietf.org/jose/>