Subject: [OAUTH-WG] Richard Barnes' Discuss on draft-ietf-oauth-json-web-token-27: (with DISCUSS and COMMENT)

From: "Richard Barnes" <[email-masked]>
Date: Wed, 01 Oct 2014 19:57:06 -0700

Richard Barnes has entered the following ballot position for
draft-ietf-oauth-json-web-token-27: Discuss

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to http://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
http://datatracker.ietf.org/doc/draft-ietf-oauth-json-web-token/

----------------------------------------------------------------------
DISCUSS:
----------------------------------------------------------------------

Section 7.
In order to prevent confusion between secured and Unsecured JWTs, the
validation steps here need to call for the application to specify which
is required.

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

Abstract.
Welsh is the only language I know of in which "w" is a vowel.  According
to Wikipedia, then, "JWT" should pronounced "joot" :)

Section 2.
It seems like "Unsecured JWT" should simply be defined as "A JWT carried
in an Unsigned JWS."

Section 4.1.
I'm a little surprised not to see a "jwk" claim, which would basically
enable JWTs to sub in for certificates for many use cases.  Did the WG
consider this possibility?

---

From: Mike Jones <[email-masked]>
Date: Mon, 6 Oct 2014 07:54:19 +0000

Thanks for your review, Richard.  My responses are inline below...

> -----Original Message-----
> From: OAuth [mailto:[email-masked]] On Behalf Of Richard Barnes
> Sent: Wednesday, October 01, 2014 7:57 PM
> To: The IESG
> Cc: [email-masked]; [email-masked]; draft-ietf-oauth-json-web-
> [email-masked]
> Subject: [OAUTH-WG] Richard Barnes' Discuss on draft-ietf-oauth-json-web-
> token-27: (with DISCUSS and COMMENT)
> 
> When responding, please keep the subject line intact and reply to all email
> addresses included in the To and CC lines. (Feel free to cut this introductory
> paragraph, however.)
> 
> 
> validation steps here need to call for the application to specify which is required.

Per my response on your JWS comments, this is already handed in a more general way in the JWS validation steps.  Specifically, the last paragraph of Section 5.2 is:

"Finally, note that it is an application decision which algorithms are acceptable in a given context. Even if a JWS can be successfully validated, unless the algorithm(s) used in the JWS are acceptable to the application, it SHOULD reject the JWS."

I would therefore request that you likewise withdraw this DISCUSS on that basis.

> Welsh is the only language I know of in which "w" is a vowel.  According to
> Wikipedia, then, "JWT" should pronounced "joot" :)

You're not the only person with knowledge of Welsh to have made this comment.  And this is a Jones responding to you... ;-)

> Section 2.
> It seems like "Unsecured JWT" should simply be defined as "A JWT carried in an
> Unsigned JWS."

It's been useful in other specifications that are applications of JWTs to have a name for this kind of JWT, since it occurs frequently.

> Section 4.1.
> I'm a little surprised not to see a "jwk" claim, which would basically enable JWTs
> to sub in for certificates for many use cases.  Did the WG consider this
> possibility?

Not to my knowledge.  However, I know of several applications in which JWKs and JWK Sets are carried as claims in JWTs of various kinds - just using claim names that are informed by the context of the particular application.  For instance, draft-ietf-oauth-dyn-reg uses a "jwks_uri" claim to pass a JWK Set by reference and a "jwks" claim to pass a JWK Set by value.

> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth

				Thanks again,
				-- Mike

---

From: Richard Barnes <[email-masked]>
Date: Fri, 10 Oct 2014 17:37:11 -0400

On Mon, Oct 6, 2014 at 3:54 AM, Mike Jones <[email-masked]>
wrote:

> email
> Per my response on your JWS comments, this is already handed in a more
> general way in the JWS validation steps.  Specifically, the last paragraph
> of Section 5.2 is:
>
> "Finally, note that it is an application decision which algorithms are
> acceptable in a given context. Even if a JWS can be successfully validated,
> unless the algorithm(s) used in the JWS are acceptable to the application,
> it SHOULD reject the JWS."
>

I've cleared this DISCUSS in the interest of having this fight over in JWS
thread.  But I also added the following COMMENT:
"It would be good for this document to pass on the note from JWS about
selecting which algorithms are acceptable, and in particular, whether
unsecured JWTs are acceptable."

--Richard

> to
> You're not the only person with knowledge of Welsh to have made this
> comment.  And this is a Jones responding to you... ;-)
>
> > Section 2.
> in an
> It's been useful in other specifications that are applications of JWTs to
> have a name for this kind of JWT, since it occurs frequently.
>
> > Section 4.1.
> enable JWTs
> Not to my knowledge.  However, I know of several applications in which
> JWKs and JWK Sets are carried as claims in JWTs of various kinds - just
> using claim names that are informed by the context of the particular
> application.  For instance, draft-ietf-oauth-dyn-reg uses a "jwks_uri"
> claim to pass a JWK Set by reference and a "jwks" claim to pass a JWK Set
> by value.
>

---

From: Mike Jones <[email-masked]>
Date: Sat, 11 Oct 2014 19:54:20 +0000

> From: Richard Barnes [mailto:[email-masked]] 
> Sent: Friday, October 10, 2014 2:37 PM
> To: Mike Jones
> Cc: The IESG; [email-masked]; [email-masked]; [email-masked]
> Subject: Re: [OAUTH-WG] Richard Barnes' Discuss on draft-ietf-oauth-json-web-token-27: (with DISCUSS and COMMENT)
> 
> On Mon, Oct 6, 2014 at 3:54 AM, Mike Jones <[email-masked]> wrote:
> I've cleared this DISCUSS in the interest of having this fight over in JWS thread.  But I also added the following COMMENT:
> "It would be good for this document to pass on the note from JWS about selecting which algorithms are acceptable, and in particular, whether unsecured JWTs are acceptable."

Thanks for clearing the DISCUSS.  I'm fine repeating the note about acceptable algorithms in the JWT spec, assuming others are.

				-- Mike

---

From: Kathleen Moriarty <[email-masked]>
Date: Sat, 11 Oct 2014 17:42:12 -0400

Mike,

Are you about ready to post an update so we can clear some of the discusses and comments that have been agreed to (like the comment added below when the discuss of Richard's was removed)?

It will help ADs if we are able to reduce and work on the rest.  I find sooner rather than later to be easier so they don't need to figure out the issues again to clear things that have been agreed upon.

It doesn't need to be over the weekend :-)

Thank you!
Kathleen

Sent from my iPhone

---

From: Mike Jones <[email-masked]>
Date: Sat, 11 Oct 2014 22:23:52 +0000

I hope to be ready to post updated drafts incorporating the proposed resolutions on Monday or Tuesday.

				-- Mike

-----Original Message-----
From: Kathleen Moriarty [mailto:[email-masked]] 
Sent: Saturday, October 11, 2014 2:42 PM
To: Mike Jones
Cc: Richard Barnes; [email-masked]; [email-masked]; The IESG; [email-masked]
Subject: Re: [OAUTH-WG] Richard Barnes' Discuss on draft-ietf-oauth-json-web-token-27: (with DISCUSS and COMMENT)

Mike,

Thank you!
Kathleen

Sent from my iPhone

On Oct 11, 2014, at 3:54 PM, Mike Jones <[email-masked]> wrote:

>> Cc: The IESG; [email-masked]; [email-masked]; 
>> [email-masked]
>> Subject: Re: [OAUTH-WG] Richard Barnes' Discuss on 
>> draft-ietf-oauth-json-web-token-27: (with DISCUSS and COMMENT)
>> 
>>> Cc: [email-masked]; [email-masked]; 
>>> draft-ietf-oauth-json-web- [email-masked]
>>> When responding, please keep the subject line intact and reply to 
>>> all email addresses included in the To and CC lines. (Feel free to 
>>> cut this introductory paragraph, however.)
>>> 
>>> 
>>> Please refer to 
>>> http://www.ietf.org/iesg/statement/discuss-criteria.html
>>> In order to prevent confusion between secured and Unsecured JWTs, 
>>> the validation steps here need to call for the application to specify which is required.
>>

---

From: Brian Campbell <[email-masked]>
Date: Mon, 13 Oct 2014 05:18:10 -0600

Repeating the note about acceptable algorithms in the JWT spec sounds fine.

On Sat, Oct 11, 2014 at 1:54 PM, Mike Jones <[email-masked]>
wrote:

> > I've cleared this DISCUSS in the interest of having this fight over in
> JWS thread.  But I also added the following COMMENT:
> Thanks for clearing the DISCUSS.  I'm fine repeating the note about
> acceptable algorithms in the JWT spec, assuming others are.
>