Subject: [Acme] Minor fix for JWS signature algorithms

From: Richard Barnes <[email-masked]>
Date: Tue, 29 Nov 2016 16:00:00 -0500

As I was chatting with someone about ACME today, I noticed a minor problem:
The choice of JWS signing algorithm is made by the client, but it has to
choose an algorithm that the server supports.  I just posted a PR that
enables the server to refuse a JWS because it doesn't like the signature
algorithm, and indicate in the error what algorithms it would prefer.

https://github.com/ietf-wg-acme/acme/pull/218

---

From: Ted Hardie <[email-masked]>
Date: Tue, 29 Nov 2016 14:38:46 -0800

Taking a look at this, I wonder a bit if we are not over-using 403.  At the
moment we use 403 and a reason for pre-auth failure, ToS failure, and now
for algorithm signature mismatch.
That's a lot of different bike sheds covered with the same paint.  Maybe
that uniformity is good, but , especially in this last case, I think a
regular 400 + reason code is a closer fit (it's not really "forbidden" it's
"fix your syntax").

Is there a strong reason to see this as "forbidden" that I'm not seeing?

(As an individual, in case that's not clear)

Ted

On Tue, Nov 29, 2016 at 1:00 PM, Richard Barnes <[email-masked]> wrote:

> As I was chatting with someone about ACME today, I noticed a minor
> problem: The choice of JWS signing algorithm is made by the client, but it
> has to choose an algorithm that the server supports.  I just posted a PR
> that enables the server to refuse a JWS because it doesn't like the
> signature algorithm, and indicate in the error what algorithms it would
> prefer.
>
> _______________________________________________
> Acme mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/acme
>
>

---

From: Martin Thomson <[email-masked]>
Date: Wed, 30 Nov 2016 12:09:31 +1100

> regular 400 + reason code is a closer fit (it's not really "forbidden" it's

Yup, this is a straight up "I didn't understand" response here.

---

From: Richard Barnes <[email-masked]>
Date: Tue, 29 Nov 2016 23:52:34 -0500

So, dear HTTP editor, which code should we use?

---

From: Martin Thomson <[email-masked]>
Date: Wed, 30 Nov 2016 16:15:51 +1100

> So, dear HTTP editor, which code should we use?

No need to be facetious :)

I was agreeing with Ted, if that wasn't clear.  400 is your grab bag
for "requests you don't like".  403 is generally used for cases where
authentication has been dealt with, but that is (still) insufficient.
I think that it's perfectly good for cases where the account or
signature is forbidden from making a change.

Changes of Terms of Service [sic - Changed?] 403 => 400 seems like a
better choice
Pre-Authorization 403 is probably OK here

There doesn't seem to be a good rule in these cases, but the risk is
that you slap 403 on every request that the server might want to
reject on the basis of ...stuff.