Subject: Re: [Gen-art] review: draft-ietf-jose-jwk-thumbprint-05

From: Joel Halpern <[email-masked]>
Date: Mon, 6 Jul 2015 09:18:24 -0400

The document is nearly ready for publication as a Proposed Standard.

Upon  re-review, the addition of section 3.4 raises a question of 
clarity.  As written, the text says that the hash function matters only 
to the original thumbprint provider.  Should there be a little bit of 
text talking about the need for the hash function to be the same for 
thumbprints to be comparable, or, phrased alternatively, that 
thumbprints with different hashes must not be compared?  If there were 
no need for consistent production of the thumbprint, there would be no 
need for a Proposed Standard for the document.

Yours,
Joel

The new section 3.4
On 6/19/15 12:06 PM, Joel M. Halpern wrote:
> I am the assigned Gen-ART reviewer for this draft. For background on
> Gen-ART, please see the FAQ at
>
> <http://wiki.tools.ietf.org/area/gen/trac/wiki/GenArtfaq>.
>
> Please resolve these comments along with any other Last Call comments
> you may receive.
>
> Document: draft-ietf-jose-jwk-thumbprint-05
>      JSON Web Key (JWK) Thumbprint
> Reviewer: Joel M. Halpern
> Review Date: 19-June-2015
> IETF LC End Date: N/A
> IESG Telechat date: N/A
>
> Summary: The internet draft is ready for publication as a Proposed
> Standard.
>
> [Note to readers:
> This review is provided because the spreadsheet said so.  The draft
> appears not to be in last call yet.
> Also, this reviewer did not attempt to second-guess the design choices
> made by the WG.  The choices are well-explain, and I understand it to be
> the WGs job to make them.]
>
> Major issues: N/A
>
> Minor issues: N/A
>
> Nits/editorial comments: N/A
>
> _______________________________________________
> Gen-art mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/gen-art
>

---

From: Mike Jones <[email-masked]>
Date: Mon, 6 Jul 2015 22:29:46 +0000

Hi Joel.  Thanks for looking this over again.  Section 3.4 was added in response to Adam Montville's SecDir comments, in which his focus was on cases where the hash function didn't have to be known to multiple parties.  I guess it's only fair that you focus on the cases where it does. ;-)

Currently the case you're interested in is covered by the last sentence in 3.4, which reads:
"Only if multiple parties will be reproducing the JWK Thumbprint calculation for some reason, will parties other than the original producer of the JWK Thumbprint need to know which hash function was used."

I could strength this by making it its own paragraph, saying this:
"However, in some cases multiple parties will be reproducing the JWK Thumbprint calculation and comparing the results.  In these cases, the parties will need to know which hash function was used and use the same one."

Would that work for you, or do you have alternative wording to suggest?

				Thanks again,
				-- Mike

-----Original Message-----
From: Joel Halpern [mailto:[email-masked]] 
Sent: Monday, July 06, 2015 6:18 AM
To: A. Jean Mahoney; General Area Review Team; [email-masked]
Subject: Re: [Gen-art] review: draft-ietf-jose-jwk-thumbprint-05

Upon  re-review, the addition of section 3.4 raises a question of clarity.  As written, the text says that the hash function matters only to the original thumbprint provider.  Should there be a little bit of text talking about the need for the hash function to be the same for thumbprints to be comparable, or, phrased alternatively, that thumbprints with different hashes must not be compared?  If there were no need for consistent production of the thumbprint, there would be no need for a Proposed Standard for the document.

Yours,
Joel

The new section 3.4

---

From: "Joel M. Halpern" <[email-masked]>
Date: Mon, 6 Jul 2015 18:31:48 -0400

That would work for me.  It gets in the point that the comparing entity, 
as well as the generating entity, needs to plan for this.

Thank you,
Joel

On 7/6/15 6:29 PM, Mike Jones wrote:
> Hi Joel.  Thanks for looking this over again.  Section 3.4 was added
> in response to Adam Montville's SecDir comments, in which his focus
> was on cases where the hash function didn't have to be known to
> multiple parties.  I guess it's only fair that you focus on the cases
> where it does. ;-)
>
> Currently the case you're interested in is covered by the last
> sentence in 3.4, which reads: "Only if multiple parties will be
> reproducing the JWK Thumbprint calculation for some reason, will
> parties other than the original producer of the JWK Thumbprint need
> to know which hash function was used."
>
> "However, in some cases multiple parties will be reproducing the JWK
> Thumbprint calculation and comparing the results.  In these cases,
> the parties will need to know which hash function was used and use
> the same one."
>
> Thanks again, -- Mike
> -----Original Message----- From: Joel Halpern
> [mailto:[email-masked]] Sent: Monday, July 06, 2015 6:18 AM To:
> A. Jean Mahoney; General Area Review Team;
> [email-masked] Subject: Re:
> [Gen-art] review: draft-ietf-jose-jwk-thumbprint-05
>
> clarity.  As written, the text says that the hash function matters
> only to the original thumbprint provider.  Should there be a little
> bit of text talking about the need for the hash function to be the
> same for thumbprints to be comparable, or, phrased alternatively,
> that thumbprints with different hashes must not be compared?  If
> there were no need for consistent production of the thumbprint, there
> would be no need for a Proposed Standard for the document.
>
> Yours, Joel
>
> The new section 3.4 On 6/19/15 12:06 PM, Joel M. Halpern wrote:
>> I am the assigned Gen-ART reviewer for this draft. For background
>> on Gen-ART, please see the FAQ at
>>
>> Please resolve these comments along with any other Last Call
>> comments you may receive.
>>
>> Document: draft-ietf-jose-jwk-thumbprint-05 JSON Web Key (JWK)
>> Thumbprint Reviewer: Joel M. Halpern Review Date: 19-June-2015 IETF
>> LC End Date: N/A IESG Telechat date: N/A
>>
>> [Note to readers: This review is provided because the spreadsheet
>> said so.  The draft appears not to be in last call yet. Also, this
>> reviewer did not attempt to second-guess the design choices made by
>> the WG.  The choices are well-explain, and I understand it to be
>> _______________________________________________ Gen-art mailing
>> list [email-masked]

---

From: Jari Arkko <[email-masked]>
Date: Thu, 9 Jul 2015 00:02:49 +0200

Joel - thank you very much for the review. And thanks for Addressing the issues, Mike.

Jari

On 07 Jul 2015, at 00:31, Joel M. Halpern <[email-masked]> wrote:

> That would work for me.  It gets in the point that the comparing entity, as well as the generating entity, needs to plan for this.
> 
> Thank you,
> Joel
>

---

From: Jari Arkko <[email-masked]>
Date: Thu, 9 Jul 2015 00:15:19 +0200

Thanks for your review!

On 19 Jun 2015, at 18:18, Joel M. Halpern <[email-masked]> wrote:

> Document: draft-ietf-pcp-proxy-08
>    Port Control Protocol (PCP) Proxy Function
> IETF LC End Date: 29-June-2015
> IESG Telechat date: N/A
> 
> Summary: This document is ready for publication as a Proposed Standard
> 
> Major issues:
> 
> Minor issues:
> 
> Nits/editorial comments:
>