Subject: Re: [jose] #8: Direct mode for key agreement needs security analysis

From: "jose issue tracker" <[email-masked]>
Date: Fri, 14 Jun 2013 22:35:04 -0000

#8: Direct mode for key agreement needs security analysis

Comment (by [email-masked]):

 What existing security considerations on key lifetimes of encryption keys
 would it be appropriate for us to reference?  These have to exist, albeit,
 perhaps in algorithm-specific contexts.

 Given that JOSE is only defining a representation for the inputs and
 outputs of existing algorithms, not defining new algorithms, perhaps the
 right thing to do is also the simple thing to do: state that they key
 lifetime security considerations in the specifications that define those
 algorithms continue to apply when using those algorithms using JOSE data
 structures.

-- 
-------------------------+-------------------------------------------------
 Reporter:               |       Owner:  draft-ietf-jose-json-web-
  [email-masked]        |  [email-masked]
     Type:  defect       |      Status:  new
 Priority:  major        |   Milestone:
Component:  json-web-    |     Version:
  encryption             |  Resolution:
 Severity:  Active WG    |
  Document               |
 Keywords:               |
-------------------------+-------------------------------------------------

Ticket URL: <http://trac.tools.ietf.org/wg/jose/trac/ticket/8#comment:2>
jose <http://tools.ietf.org/jose/>

---

From: "jose issue tracker" <[email-masked]>
Date: Tue, 18 Jun 2013 21:12:59 -0000

Changes (by [email-masked]):

 * status:  new => closed
 * resolution:   => wontfix

Comment:

 There is now a constrained device use case that appears to need this
 ability.  There are no known additional security considerations that would
 need to be written.  There are potentially some considerations that need
 to be made for longer term private keys, but they are different that for
 MAC keys.

-- 
-------------------------+-------------------------------------------------
 Reporter:               |       Owner:  draft-ietf-jose-json-web-
  [email-masked]        |  [email-masked]
     Type:  defect       |      Status:  closed
 Priority:  major        |   Milestone:
Component:  json-web-    |     Version:
  encryption             |  Resolution:  wontfix
 Severity:  Active WG    |
  Document               |
 Keywords:               |
-------------------------+-------------------------------------------------

Ticket URL: <http://trac.tools.ietf.org/wg/jose/trac/ticket/8#comment:3>
jose <http://tools.ietf.org/jose/>