Subject: [jose] Last Call review for the thumbprint draft

From: "Jim Schaad" <[email-masked]>
Date: Mon, 2 Feb 2015 20:56:25 -0800

1.  Please review the email from James Manger on 4/14/14.  It is not clear
to me that all of the issues he raised were addressed as there was no
response to the message.   Particularly the questions of uniqueness for
black listing of keys.

2.  There seems to be consensus to not define the new header parameter for
the time being.

3.  There does not seem to be consensus at this time for what the method of
serialization should be at this time.  The current method is deemed overly
complicated by a number of people, but nobody has proposed a method that
people can accept as being future proof in the event that a key defines a
structured field for a key parameter.   

A new draft can easily address the first two issues.  I am not sure what
procedure to follow to address the last one.  

Jim

---

From: Nat Sakimura <[email-masked]>
Date: Wed, 4 Feb 2015 12:08:58 +0900

Thanks Jim,

I will talk with Mike to come up with some plausible solutions.

Best,

Nat

2015-02-03 13:56 GMT+09:00 Jim Schaad <[email-masked]>:

> _______________________________________________
> jose mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/jose
>

-- 
Nat Sakimura (=nat)
Chairman, OpenID Foundation
http://nat.sakimura.org/
@_nat_en

---

From: Mike Jones <[email-masked]>
Date: Fri, 20 Feb 2015 00:49:58 +0000

These comments were addressed in the -02 draft.  Replies to individual comments are inline below.

> From: jose [mailto:[email-masked]] On Behalf Of Jim Schaad
> Sent: Monday, February 02, 2015 8:56 PM
> Cc: [email-masked]
> Subject: [jose] Last Call review for the thumbprint draft
>
> 1.  Please review the email from James Manger on 4/14/14.  It is not clear to me that all of the issues he raised were addressed as there was no

A detailed reply to all of James' comments was sent.  Security considerations text about the conditions that must be satisfied to achieve uniqueness of thumbprint values was added.

> 2.  There seems to be consensus to not define the new header parameter for the time being.

They were removed, per working group input.

> 3.  There does not seem to be consensus at this time for what the method of serialization should be at this time.  The current method is deemed overly complicated by a number of people, but nobody has proposed a method that people can accept as being future proof in the event that a key defines a

As previously discussed, it's fully expected that most implementations will actually just have fixed templates for the key types they use, so no sorting or other complicated steps will be involved.  Lest you blanch at the idea of having type-specific code for computing thumbprints, it's certainly the case that any code *using* keys will be type-specific, so it's not onerous to also use type-specific code to also compute key thumbprints.

Nat and I feel that the complication arguments don't stack up well compared to the benefit of having a general description of how to compute a thumbprint that works for any key type.  Other's opinions, may of course, differ. ;-)

> A new draft can easily address the first two issues.  I am not sure what procedure to follow to address the last one.
>
> Jim

				Thanks again,
				-- Mike & Nat