Subject: [OAUTH-WG] Pre-IETF 84 versions of JOSE and JWT specifications

From: Mike Jones <[email-masked]>
Date: Tue, 17 Jul 2012 01:48:05 +0000

I’ve made a minor release of the JSON WEB {Signature,Encryption,Key,Algorithms,Token} (JWS, JWE, JWK, JWA, JWT) working group specifications and the JWS and JWE JSON Serialization (JWS-JS, JWE-JS) individual submission specifications in preparation for IETF 84 in Vancouver, BC<http://www.ietf.org/meeting/84/index.html>.  These versions incorporate feedback from working group members since the major release on July 6th<http://self-issued.info/?p=759>, and update the lists of open issues in preparation for discussions in Vancouver (and on the working group mailing lists).

One significant addition is that the JWT and JWE-JS specs both now contain complete, testable examples with encrypted results.  No normative changes were made.

The working group specifications are available at:

·        http://tools.ietf.org/html/draft-ietf-jose-json-web-signature-04

·        http://tools.ietf.org/html/draft-ietf-jose-json-web-encryption-04

·        http://tools.ietf.org/html/draft-ietf-jose-json-web-key-04

·        http://tools.ietf.org/html/draft-ietf-jose-json-web-algorithms-04

·        http://tools.ietf.org/html/draft-ietf-oauth-json-web-token-02

The individual submission specifications are available at:

·        http://tools.ietf.org/html/draft-jones-jose-jws-json-serialization-01

·        http://tools.ietf.org/html/draft-jones-jose-jwe-json-serialization-01

The document history entries (also in the specifications) are as follows:

http://tools.ietf.org/html/draft-ietf-jose-json-web-signature-04

  *   Completed JSON Security Considerations section, including considerations about rejecting input with duplicate member names.
  *   Completed security considerations on the use of a SHA-1 hash when computing x5t (x.509 certificate thumbprint) values.
  *   Refer to the registries as the primary sources of defined values and then secondarily reference the sections defining the initial contents of the registries.
  *   Normatively reference XML DSIG 2.0 [W3C.CR‑xmldsig‑core2‑20120124] for its security considerations.
  *   Added this language to Registration Templates: "This name is case sensitive. Names that match other registered names in a case insensitive manner SHOULD NOT be accepted."
  *   Reference draft-jones-jose-jws-json-serialization instead of draft-jones-json-web-signature-json-serialization.
  *   Described additional open issues.
  *   Applied editorial suggestions.

http://tools.ietf.org/html/draft-ietf-jose-json-web-encryption-04

  *   Refer to the registries as the primary sources of defined values and then secondarily reference the sections defining the initial contents of the registries.
  *   Normatively reference XML Encryption 1.1 [W3C.CR‑xmlenc‑core1‑20120313] for its security considerations.
  *   Reference draft-jones-jose-jwe-json-serialization instead of draft-jones-json-web-encryption-json-serialization.
  *   Described additional open issues.
  *   Applied editorial suggestions.

http://tools.ietf.org/html/draft-ietf-jose-json-web-key-04

  *   Refer to the registries as the primary sources of defined values and then secondarily reference the sections defining the initial contents of the registries.
  *   Normatively reference XML DSIG 2.0 [W3C.CR‑xmldsig‑core2‑20120124] for its security considerations.
  *   Added this language to Registration Templates: "This name is case sensitive. Names that match other registered names in a case insensitive manner SHOULD NOT be accepted."
  *   Described additional open issues.
  *   Applied editorial suggestions.

http://tools.ietf.org/html/draft-ietf-jose-json-web-algorithms-04

  *   Added text requiring that any leading zero bytes be retained in base64url encoded key value representations for fixed-length values.
  *   Added this language to Registration Templates: "This name is case sensitive. Names that match other registered names in a case insensitive manner SHOULD NOT be accepted."
  *   Described additional open issues.
  *   Applied editorial suggestions.

http://tools.ietf.org/html/draft-ietf-oauth-json-web-token-02

  *   Added an example of an encrypted JWT.
  *   Added this language to Registration Templates: "This name is case sensitive. Names that match other registered names in a case insensitive manner SHOULD NOT be accepted."
  *   Applied editorial suggestions.

http://tools.ietf.org/html/draft-jones-jose-jws-json-serialization-01

  *   Generalized language to refer to Message Authentication Codes (MACs) rather than Hash-based Message Authentication Codes (HMACs).

http://tools.ietf.org/html/draft-jones-jose-jwe-json-serialization-01

  *   Added a complete JWE-JS example.
  *   Generalized language to refer to Message Authentication Codes (MACs) rather than Hash-based Message Authentication Codes (HMACs).

                                                            -- Mike

---

From: Anil Saldhana <[email-masked]>
Date: Fri, 27 Jul 2012 10:33:59 -0500

Mike,
   I am wondering if it is possible to change Integrity Check from "int" 
to something else in JWE?  int is a keyword in many programming 
languages and would not translate directly to classes in Java etc.

intc,intk?

Regards,
Anil

On 07/16/2012 08:48 PM, Mike Jones wrote:
>
> I've made a minor release of the JSON WEB 
> {Signature,Encryption,Key,Algorithms,Token} (JWS, JWE, JWK, JWA, JWT) 
> working group specifications and the JWS and JWE JSON Serialization 
> (JWS-JS, JWE-JS) individual submission specifications in preparation 
> for IETF 84 in Vancouver, BC 
> <http://www.ietf.org/meeting/84/index.html>.  These versions 
> incorporate feedback from working group members since the major 
> release on July 6^th <http://self-issued.info/?p=759>, and update the 
> lists of open issues in preparation for discussions in Vancouver (and 
> on the working group mailing lists).
>
> One significant addition is that the JWT and JWE-JS specs both now 
> contain complete, testable examples with encrypted results.  No 
> normative changes were made.
>
> ·http://tools.ietf.org/html/draft-ietf-jose-json-web-signature-04
>
> ·http://tools.ietf.org/html/draft-ietf-jose-json-web-encryption-04
>
> ·http://tools.ietf.org/html/draft-ietf-jose-json-web-key-04
>
> ·http://tools.ietf.org/html/draft-ietf-jose-json-web-algorithms-04
>
> ·http://tools.ietf.org/html/draft-ietf-oauth-json-web-token-02
>
> ·http://tools.ietf.org/html/draft-jones-jose-jws-json-serialization-01
>
> ·http://tools.ietf.org/html/draft-jones-jose-jwe-json-serialization-01
>
>   * Completed JSON Security Considerations section, including
>     considerations about rejecting input with duplicate member names.
>   * Completed security considerations on the use of a SHA-1 hash when
>     computing x5t(x.509 certificate thumbprint) values.
>   * Refer to the registries as the primary sources of defined values
>     and then secondarily reference the sections defining the initial
>     contents of the registries.
>   * Normatively reference XML DSIG 2.0 [W3C.CR-xmldsig-core2-20120124]
>     for its security considerations.
>   * Added this language to Registration Templates: "This name is case
>     sensitive. Names that match other registered names in a case
>     insensitive manner SHOULD NOT be accepted."
>   * Reference draft-jones-jose-jws-json-serialization instead of
>     draft-jones-json-web-signature-json-serialization.
>   * Refer to the registries as the primary sources of defined values
>     and then secondarily reference the sections defining the initial
>     contents of the registries.
>   * Normatively reference XML Encryption 1.1
>     [W3C.CR-xmlenc-core1-20120313] for its security considerations.
>   * Reference draft-jones-jose-jwe-json-serialization instead of
>     draft-jones-json-web-encryption-json-serialization.
>   * Refer to the registries as the primary sources of defined values
>     and then secondarily reference the sections defining the initial
>     contents of the registries.
>   * Normatively reference XML DSIG 2.0 [W3C.CR-xmldsig-core2-20120124]
>     for its security considerations.
>   * Added this language to Registration Templates: "This name is case
>     sensitive. Names that match other registered names in a case
>     insensitive manner SHOULD NOT be accepted."
>   * Added text requiring that any leading zero bytes be retained in
>     base64url encoded key value representations for fixed-length values.
>   * Added this language to Registration Templates: "This name is case
>     sensitive. Names that match other registered names in a case
>     insensitive manner SHOULD NOT be accepted."
>   * Added this language to Registration Templates: "This name is case
>     sensitive. Names that match other registered names in a case
>     insensitive manner SHOULD NOT be accepted."
>   * Generalized language to refer to Message Authentication Codes
>     (MACs) rather than Hash-based Message Authentication Codes (HMACs).
>
>   * Generalized language to refer to Message Authentication Codes
>     (MACs) rather than Hash-based Message Authentication Codes (HMACs).
>
> -- Mike
>
>
>
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth

---

From: Mike Jones <[email-masked]>
Date: Fri, 27 Jul 2012 17:58:12 +0000

I’d suggest representing that member with a struct/class member name like “integrity_value” then.  Also, per an open issue in the JWE spec, there’s a possibility of this field changing, so stay tuned…

Are you doing a Java implementation of the JOSE specs?  And JWT?

By the way, you should discuss JWE issues on the [email-masked]<mailto:[email-masked]> list, rather than the OAuth list.

                                                            Best wishes,
                                                            -- Mike

From: [email-masked] [mailto:[email-masked]] On Behalf Of Anil Saldhana
Sent: Friday, July 27, 2012 8:34 AM
To: [email-masked]
Subject: Re: [OAUTH-WG] Pre-IETF 84 versions of JOSE and JWT specifications

Mike,
  I am wondering if it is possible to change Integrity Check from "int" to something else in JWE?  int is a keyword in many programming languages and would not translate directly to classes in Java etc.

intc,intk?

Regards,
Anil

&#61623        http://tools.ietf.org/html/draft-ietf-jose-json-web-signature-04

&#61623        http://tools.ietf.org/html/draft-ietf-jose-json-web-encryption-04

&#61623        http://tools.ietf.org/html/draft-ietf-jose-json-web-key-04

&#61623        http://tools.ietf.org/html/draft-ietf-jose-json-web-algorithms-04

&#61623        http://tools.ietf.org/html/draft-ietf-oauth-json-web-token-02

&#61623        http://tools.ietf.org/html/draft-jones-jose-jws-json-serialization-01

&#61623        http://tools.ietf.org/html/draft-jones-jose-jwe-json-serialization-01

http://tools.ietf.org/html/draft-ietf-jose-json-web-signature-04
&#61623        Completed JSON Security Considerations section, including considerations about rejecting input with duplicate member names.
&#61623        Completed security considerations on the use of a SHA-1 hash when computing x5t (x.509 certificate thumbprint) values.
&#61623        Refer to the registries as the primary sources of defined values and then secondarily reference the sections defining the initial contents of the registries.
&#61623        Normatively reference XML DSIG 2.0 [W3C.CR‑xmldsig‑core2‑20120124] for its security considerations.
&#61623        Added this language to Registration Templates: "This name is case sensitive. Names that match other registered names in a case insensitive manner SHOULD NOT be accepted."
&#61623        Reference draft-jones-jose-jws-json-serialization instead of draft-jones-json-web-signature-json-serialization.
&#61623        Described additional open issues.
&#61623        Applied editorial suggestions.

http://tools.ietf.org/html/draft-ietf-jose-json-web-encryption-04
&#61623        Refer to the registries as the primary sources of defined values and then secondarily reference the sections defining the initial contents of the registries.
&#61623        Normatively reference XML Encryption 1.1 [W3C.CR‑xmlenc‑core1‑20120313] for its security considerations.
&#61623        Reference draft-jones-jose-jwe-json-serialization instead of draft-jones-json-web-encryption-json-serialization.
&#61623        Described additional open issues.
&#61623        Applied editorial suggestions.

http://tools.ietf.org/html/draft-ietf-jose-json-web-key-04
&#61623        Refer to the registries as the primary sources of defined values and then secondarily reference the sections defining the initial contents of the registries.
&#61623        Normatively reference XML DSIG 2.0 [W3C.CR‑xmldsig‑core2‑20120124] for its security considerations.
&#61623        Added this language to Registration Templates: "This name is case sensitive. Names that match other registered names in a case insensitive manner SHOULD NOT be accepted."
&#61623        Described additional open issues.
&#61623        Applied editorial suggestions.

http://tools.ietf.org/html/draft-ietf-jose-json-web-algorithms-04
&#61623        Added text requiring that any leading zero bytes be retained in base64url encoded key value representations for fixed-length values.
&#61623        Added this language to Registration Templates: "This name is case sensitive. Names that match other registered names in a case insensitive manner SHOULD NOT be accepted."
&#61623        Described additional open issues.
&#61623        Applied editorial suggestions.

http://tools.ietf.org/html/draft-ietf-oauth-json-web-token-02
&#61623        Added an example of an encrypted JWT.
&#61623        Added this language to Registration Templates: "This name is case sensitive. Names that match other registered names in a case insensitive manner SHOULD NOT be accepted."
&#61623        Applied editorial suggestions.

http://tools.ietf.org/html/draft-jones-jose-jws-json-serialization-01
&#61623        Generalized language to refer to Message Authentication Codes (MACs) rather than Hash-based Message Authentication Codes (HMACs).

http://tools.ietf.org/html/draft-jones-jose-jwe-json-serialization-01
&#61623        Added a complete JWE-JS example.
&#61623        Generalized language to refer to Message Authentication Codes (MACs) rather than Hash-based Message Authentication Codes (HMACs).

                                                            -- Mike

OAuth mailing list

[email-masked]<mailto:[email-masked]>