Subject: [jose] way forward for two remaining drafts

From: Karen O'Donoghue <[email-masked]>
Date: Wed, 1 Jul 2015 15:37:31 +0000

Folks,

With the thumbprint draft progressing through the process, we have two remaining individual drafts to decide what to do with. The options include: 1) adopt as working group drafts; 2) ask for AD sponsorship of individual drafts; or 3) recommend that they not be published. Please express your thoughts on what we should do with these drafts. Jim, Kathleen, and I would like to make a decision in the Prague timeframe, so please respond by 15 July.

https://tools.ietf.org/id/draft-jones-jose-jws-signing-input-options-00.txt

https://tools.ietf.org/id/draft-jones-jose-key-managed-json-web-signature-01.txt

Thanks,
Karen

---

From: Anders Rundgren <[email-masked]>
Date: Wed, 1 Jul 2015 18:28:09 +0200

On 2015-07-01 17:37, Karen O'Donoghue wrote:
> Folks,
>
> With the thumbprint draft progressing through the process, we have
 > two remaining individual drafts to decide what to do with. The options
 > include: 1) adopt as working group drafts; 2) ask for AD sponsorship of
 > individual drafts; or 3) recommend that they not be published. Please
 > express your thoughts on what we should do with these drafts. Jim, Kathleen,
 > and I would like to make a decision in the Prague timeframe, so please respond by 15 July.

Dear Karen,

I have seen considerable interest in groups like ACME and W3C Web Payments for
JSON-based signature schemes that does not require Base64-encoded payloads like:

Therefore I support progression of this I-D.

Sincerely,
Anders Rundgren

> _______________________________________________
> jose mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/jose
>

---

From: Brian Campbell <[email-masked]>
Date: Wed, 1 Jul 2015 10:31:49 -0600

For
https://tools.ietf.org/id/draft-jones-jose-key-managed-json-web-signature-01.txt
I'd recommend that it not be published or pursued further.

Perhaps my view is narrow or naive but I don't see the value in having the
key key management layer for a MAC key. The very question of "why" was asked
<https://www.ietf.org/mail-archive/web/jose/current/msg04957.html> twice
<https://www.ietf.org/mail-archive/web/jose/current/msg04996.html> during
the course of one of the only threads on the WG list regarding KMJWS
<https://www.ietf.org/mail-archive/web/jose/current/threads.html#04956>but
was never answered that I can see. Perhaps the question was lost amidst the
lively rhetoric in the rest of the thread. But I think it's a valid
question nonetheless and, short of hearing some pretty compelling answers,
I don't see any reason to add another document and the additional options
and complexity that it'd bring.

I do also see the potential for confusion and security problems arising
from maybe thinking, of having the interaction between libraries and
applications tricked into thinking, that combinations like
{"alg":"RSA-OAEP","mac":"HS256"} used in the draft
<https://tools.ietf.org/html/draft-jones-jose-key-managed-json-web-signature-01#appendix-A>
provides more than it actually does, which is only an assurance of
integrity of the message since the MAC was computed by any anonymous sender
and doesn't authenticate the sender in any way.

I don't have strong opinions about
https://tools.ietf.org/id/draft-jones-jose-jws-signing-input-options-00.txt
as I've not seen a need for it in my work but there seems to be other
interest in such a scheme.

On Wed, Jul 1, 2015 at 9:37 AM, Karen O'Donoghue <[email-masked]> wrote:

>  Folks,
>
>  With the thumbprint draft progressing through the process, we have two
> remaining individual drafts to decide what to do with. The options include:
> 1) adopt as working group drafts; 2) ask for AD sponsorship of individual
> drafts; or 3) recommend that they not be published. Please express your
> thoughts on what we should do with these drafts. Jim, Kathleen, and I would
> like to make a decision in the Prague timeframe, so please respond by 15
> July.
>
>

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Thu, 2 Jul 2015 15:52:29 -0400

> https://tools.ietf.org/id/draft-jones-jose-key-managed-json-web-signature-01.txt

I would very much like us to avoid the need to base64 encode payloads in
protocols like ACME. HTTP is 8 bit clean by design and thus no need to base
64.

So I support draft-jones-jose-jws-signing-input-options-00 going forward on
standards track.

---

From: Martin Thomson <[email-masked]>
Date: Thu, 2 Jul 2015 13:26:36 -0700

> https://tools.ietf.org/id/draft-jones-jose-jws-signing-input-options-00.txt

I would like to see some discriminator added to the input for the
(false, false) option this proposes.  As it stands, the payload is the
only input.  Restricting the space of what might be signed ensures
that signatures can't be transplanted.  A fixed string would suffice.

---

From: Mike Jones <[email-masked]>
Date: Thu, 9 Jul 2015 17:16:22 +0000

About https://tools.ietf.org/html/draft-jones-jose-jws-signing-input-options-00, I'll add that this addresses the requests make by Jim Schaad and Richard Barnes in JOSE Issues #26 "Allow for signature payload to not be base64 encoded" and #23 http://trac.tools.ietf.org/wg/jose/trac/ticket/23 "Make crypto independent of binary encoding (base64)".

About https://tools.ietf.org/html/draft-jones-jose-key-managed-json-web-signature-01, I'll add that this addresses the request made by Jim Schaad in JOSE Issue #2 http://trac.tools.ietf.org/wg/jose/trac/ticket/2 "No key management for MAC".

Also, there's a highly relevant discussion about key management for MACs going on in the COSE working group.  See the thread "[Cose] Key management for MACs (was Re: Review of draft-schaad-cose-msg-01)" - especially https://mailarchive.ietf.org/arch/msg/cose/aUehU6O7Ui8CXcGxy3TquZOxWH4 and https://mailarchive.ietf.org/arch/msg/cose/ouOIdAOe2P-W8BjGLJ7BNvvRr10.

One could take the view that our decision on the JOSE key management draft should be informed by the related decision in COSE.  Specifically, that if COSE decides to support key management for MACs, the same reasoning likely should apply to our decision on whether to define a standard mechanism for supporting key management for MACs in JOSE.

                                                            -- Mike

From: jose [mailto:[email-masked]] On Behalf Of Karen O'Donoghue
Sent: Wednesday, July 01, 2015 8:38 AM
To: [email-masked]
Subject: [jose] way forward for two remaining drafts

Folks,

Thanks,
Karen

---

From: Mike Jones <[email-masked]>
Date: Thu, 9 Jul 2015 17:18:44 +0000

Oops - adding the link to issue #26:  http://trac.tools.ietf.org/wg/jose/trac/ticket/26.

From: jose [mailto:[email-masked]] On Behalf Of Mike Jones
Sent: Thursday, July 09, 2015 10:16 AM
To: Karen O'Donoghue; [email-masked]
Subject: Re: [jose] way forward for two remaining drafts

                                                            -- Mike

From: jose [mailto:[email-masked]] On Behalf Of Karen O'Donoghue
Sent: Wednesday, July 01, 2015 8:38 AM
To: [email-masked]<mailto:[email-masked]>
Subject: [jose] way forward for two remaining drafts

Folks,

Thanks,
Karen

---

From: Kathleen Moriarty <[email-masked]>
Date: Thu, 9 Jul 2015 13:37:10 -0400

Hi,

Sent from my iPhone

> On Jul 9, 2015, at 1:16 PM, Mike Jones <[email-masked]> wrote:
> 
> About https://tools.ietf.org/html/draft-jones-jose-jws-signing-input-options-00, I’ll add that this addresses the requests make by Jim Schaad and Richard Barnes in JOSE Issues #26 “Allow for signature payload to not be base64 encoded” and #23 http://trac.tools.ietf.org/wg/jose/trac/ticket/23 “Make crypto independent of binary encoding (base64)”.
>  
> About https://tools.ietf.org/html/draft-jones-jose-key-managed-json-web-signature-01, I’ll add that this addresses the request made by Jim Schaad in JOSE Issue #2 http://trac.tools.ietf.org/wg/jose/trac/ticket/2 “No key management for MAC”.
>  
> Also, there’s a highly relevant discussion about key management for MACs going on in the COSE working group.  See the thread “[Cose] Key management for MACs (was Re: Review of draft-schaad-cose-msg-01)” – especially https://mailarchive.ietf.org/arch/msg/cose/aUehU6O7Ui8CXcGxy3TquZOxWH4 and https://mailarchive.ietf.org/arch/msg/cose/ouOIdAOe2P-W8BjGLJ7BNvvRr10.
>  
Key management is explicitly out-of-scope for COSE as stated in the charter.  The discussion referenced had this point at the close of that discussion.

I'm not seeing much support for these drafts moving forward in JOSE.  I'm also not seeing enough to justify standards track and AD sponsored.  If you think these are important to have move forward in the WG or as standards track, please say so soon.  They can still go forward through the Independent submission process through the ISE.

Thank you,
Kathleen

---

From: Nat Sakimura <[email-masked]>
Date: Mon, 13 Jul 2015 02:32:15 +0900

Sorry to chime in so late. I have been completely under water for sometime
now.

Like Phil, I do see that draft-jones-jose-jws-signing-input-options sort of
thing can be very useful, though I may want to have slightly different way
of encoding the things. Being able to do detached signature is quite
attractive.

Best,

Nat

2015-07-10 2:37 GMT+09:00 Kathleen Moriarty <
[email-masked]>:

>  About
> https://tools.ietf.org/html/draft-jones-jose-jws-signing-input-options-00,
> I’ll add that this addresses the requests make by Jim Schaad and Richard
> Barnes in JOSE Issues #26 “Allow for signature payload to not be base64
> encoded” and #23 http://trac.tools.ietf.org/wg/jose/trac/ticket/23 “Make
> crypto independent of binary encoding (base64)”.
>
>
>
> About
> https://tools.ietf.org/html/draft-jones-jose-key-managed-json-web-signature-01,
> I’ll add that this addresses the request made by Jim Schaad in JOSE Issue
> #2 http://trac.tools.ietf.org/wg/jose/trac/ticket/2 “No key management
> for MAC”.
>
>
>
> Also, there’s a highly relevant discussion about key management for MACs
> going on in the COSE working group.  See the thread “[Cose] Key
> management for MACs (was Re: Review of draft-schaad-cose-msg-01)” –
> especially
> https://mailarchive.ietf.org/arch/msg/cose/aUehU6O7Ui8CXcGxy3TquZOxWH4
> and https://mailarchive.ietf.org/arch/msg/cose/ouOIdAOe2P-W8BjGLJ7BNvvRr10
> .
>
>
>
> One could take the view that our decision on the JOSE key management draft
> should be informed by the related decision in COSE.  Specifically, that if
> COSE decides to support key management for MACs, the same reasoning likely
> should apply to our decision on whether to define a standard mechanism for
> supporting key management for MACs in JOSE.
>
>
>
> Key management is explicitly out-of-scope for COSE as stated in the
> charter.  The discussion referenced had this point at the close of that
> discussion.
>
> I'm not seeing much support for these drafts moving forward in JOSE.  I'm
> also not seeing enough to justify standards track and AD sponsored.  If you
> think these are important to have move forward in the WG or as standards
> track, please say so soon.  They can still go forward through the
> Independent submission process through the ISE.
>
> Thank you,
> Kathleen
>
>                                                             -- Mike
>
>
>
> *From:* jose [mailto:[email-masked] <[email-masked]>] *On
> Behalf Of *Karen O'Donoghue
> *Sent:* Wednesday, July 01, 2015 8:38 AM
> *To:* [email-masked]
> *Subject:* [jose] way forward for two remaining drafts
>
>
>
> Folks,
>
>
>

-- 
Nat Sakimura (=nat)
Chairman, OpenID Foundation
http://nat.sakimura.org/
@_nat_en

---

From: John Bradley <[email-masked]>
Date: Sun, 12 Jul 2015 13:57:58 -0500

In some recent discussions, it seems that this might be useful for some of the POP use cases.

At least the idea of a detached body.   The specifics of the proposal need to be reviewed.

Also as a FYI I may have a new JWA EC alg that I have been discussing with NIST that may need to have a spec to get registered.
We weren’t able to get a doc together before Prague (I am trying not to do it unless it is really needed).  

This may or may not influence wanting to keep the WG around.

John B.

> On Jul 12, 2015, at 12:32 PM, Nat Sakimura <[email-masked]> wrote:
> 
> Sorry to chime in so late. I have been completely under water for sometime now. 
> 
> Like Phil, I do see that draft-jones-jose-jws-signing-input-options sort of thing can be very useful, though I may want to have slightly different way of encoding the things. Being able to do detached signature is quite attractive. 
> 
> Best, 
> 
> Nat
> 
> 2015-07-10 2:37 GMT+09:00 Kathleen Moriarty <[email-masked] <mailto:[email-masked]>>:
> Hi,
> 
> Sent from my iPhone
> 
> On Jul 9, 2015, at 1:16 PM, Mike Jones <[email-masked] <mailto:[email-masked]>> wrote:
> 
>> About https://tools.ietf.org/html/draft-jones-jose-jws-signing-input-options-00 <https://tools.ietf.org/html/draft-jones-jose-jws-signing-input-options-00>, I’ll add that this addresses the requests make by Jim Schaad and Richard Barnes in JOSE Issues #26 “Allow for signature payload to not be base64 encoded” and #23 http://trac.tools.ietf.org/wg/jose/trac/ticket/23 <http://trac.tools.ietf.org/wg/jose/trac/ticket/23> “Make crypto independent of binary encoding (base64)”.
>> 
>>  
>> 
>> About https://tools.ietf.org/html/draft-jones-jose-key-managed-json-web-signature-01 <https://tools.ietf.org/html/draft-jones-jose-key-managed-json-web-signature-01>, I’ll add that this addresses the request made by Jim Schaad in JOSE Issue #2 http://trac.tools.ietf.org/wg/jose/trac/ticket/2 <http://trac.tools.ietf.org/wg/jose/trac/ticket/2> “No key management for MAC”.
>> 
>>  
>> 
>> Also, there’s a highly relevant discussion about key management for MACs going on in the COSE working group.  See the thread “[Cose] Key management for MACs (was Re: Review of draft-schaad-cose-msg-01)” – especially https://mailarchive.ietf.org/arch/msg/cose/aUehU6O7Ui8CXcGxy3TquZOxWH4 <https://mailarchive.ietf.org/arch/msg/cose/aUehU6O7Ui8CXcGxy3TquZOxWH4> andhttps://mailarchive.ietf.org/arch/msg/cose/ouOIdAOe2P-W8BjGLJ7BNvvRr10 <https://mailarchive.ietf.org/arch/msg/cose/ouOIdAOe2P-W8BjGLJ7BNvvRr10>.
>> 
>>  
>> 
>> From: jose [mailto:[email-masked] <mailto:[email-masked]>] On Behalf Of Karen O'Donoghue
>> To: [email-masked] <mailto:[email-masked]>
>> https://tools.ietf.org/id/draft-jones-jose-jws-signing-input-options-00.txt <https://tools.ietf.org/id/draft-jones-jose-jws-signing-input-options-00.txt>
>>  
>> 
>> https://tools.ietf.org/id/draft-jones-jose-key-managed-json-web-signature-01.txt <https://tools.ietf.org/id/draft-jones-jose-key-managed-json-web-signature-01.txt>
>>  
>> 
>> Thanks,
>> 
>> Karen
>> 
>> [email-masked] <mailto:[email-masked]>
>> https://www.ietf.org/mailman/listinfo/jose <https://www.ietf.org/mailman/listinfo/jose>
> 
> [email-masked] <mailto:[email-masked]>
> https://www.ietf.org/mailman/listinfo/jose <https://www.ietf.org/mailman/listinfo/jose>
> 
> 
> 
> 
> -- 
> Nat Sakimura (=nat)
> http://nat.sakimura.org/ <http://nat.sakimura.org/>
> @_nat_en

---

From: <[email-masked]>
Date: Mon, 13 Jul 2015 17:16:13 +0200

+1

From: jose [mailto:[email-masked]] On Behalf Of Nat Sakimura
Sent: Sonntag, 12. Juli 2015 19:32
To: Kathleen Moriarty
Cc: Mike Jones; Karen O'Donoghue; [email-masked]
Subject: Re: [jose] way forward for two remaining drafts

Best,

Nat

2015-07-10 2:37 GMT+09:00 Kathleen Moriarty <[email-masked]<mailto:[email-masked]>>:
Hi,

Sent from my iPhone

On Jul 9, 2015, at 1:16 PM, Mike Jones <[email-masked]<mailto:[email-masked]>> wrote:
About https://tools.ietf.org/html/draft-jones-jose-jws-signing-input-options-00, I’ll add that this addresses the requests make by Jim Schaad and Richard Barnes in JOSE Issues #26 “Allow for signature payload to not be base64 encoded” and #23 http://trac.tools.ietf.org/wg/jose/trac/ticket/23 “Make crypto independent of binary encoding (base64)”.

Thank you,
Kathleen

                                                            -- Mike

Folks,

Thanks,
Karen
_______________________________________________
jose mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/jose

_______________________________________________
jose mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/jose

---

From: nov matake <[email-masked]>
Date: Tue, 14 Jul 2015 00:27:55 +0900

+1

> On Jul 14, 2015, at 00:16, <[email-masked]> <[email-masked]> wrote:
> 
> +1
>  
>  
> About https://tools.ietf.org/html/draft-jones-jose-key-managed-json-web-signature-01 <https://tools.ietf.org/html/draft-jones-jose-key-managed-json-web-signature-01>, I’ll add that this addresses the request made by Jim Schaad in JOSE Issue #2 http://trac.tools.ietf.org/wg/jose/trac/ticket/2 <http://trac.tools.ietf.org/wg/jose/trac/ticket/2>“No key management for MAC”.
>  
> Also, there’s a highly relevant discussion about key management for MACs going on in the COSE working group.  See the thread “[Cose] Key management for MACs (was Re: Review of draft-schaad-cose-msg-01)” – especially https://mailarchive.ietf.org/arch/msg/cose/aUehU6O7Ui8CXcGxy3TquZOxWH4 <https://mailarchive.ietf.org/arch/msg/cose/aUehU6O7Ui8CXcGxy3TquZOxWH4>and https://mailarchive.ietf.org/arch/msg/cose/ouOIdAOe2P-W8BjGLJ7BNvvRr10 <https://mailarchive.ietf.org/arch/msg/cose/ouOIdAOe2P-W8BjGLJ7BNvvRr10>.
>

---

From: Prabath Siriwardena <[email-masked]>
Date: Mon, 13 Jul 2015 08:51:08 -0700

+1

Thanks & regards,
-Prabath

On Sun, Jul 12, 2015 at 10:32 AM, Nat Sakimura <[email-masked]> wrote:

> Like Phil, I do see that draft-jones-jose-jws-signing-input-options sort
> of thing can be very useful, though I may want to have slightly different
> way of encoding the things. Being able to do detached signature is quite
> attractive.
>
> Best,
>
> Nat
>
>> and
>> https://mailarchive.ietf.org/arch/msg/cose/ouOIdAOe2P-W8BjGLJ7BNvvRr10.
>>
>>
>>
>> One could take the view that our decision on the JOSE key management
>> draft should be informed by the related decision in COSE.  Specifically,
>> that if COSE decides to support key management for MACs, the same reasoning
>> likely should apply to our decision on whether to define a standard
>> mechanism for supporting key management for MACs in JOSE.
>>
>>
>>

-- 
Thanks & Regards,
Prabath

Twitter : @prabath
LinkedIn : http://www.linkedin.com/in/prabathsiriwardena

Mobile : +1 650 625 7950

http://blog.facilelogin.com
http://blog.api-security.org

---

From: Edmund Jay <[email-masked]>
Date: Mon, 13 Jul 2015 17:10:38 +0000 (UTC)

+1

      From: Nat Sakimura <[email-masked]>
 To: Kathleen Moriarty <[email-masked]> 
Cc: Mike Jones <[email-masked]>; Karen O'Donoghue <[email-masked]>; "[email-masked]" <[email-masked]> 
 Sent: Sunday, July 12, 2015 10:32 AM
 Subject: Re: [jose] way forward for two remaining drafts

Best, 
Nat
2015-07-10 2:37 GMT+09:00 Kathleen Moriarty <[email-masked]>:

Hi,

Sent from my iPhone

Abouthttps://tools.ietf.org/html/draft-jones-jose-jws-signing-input-options-00, I’ll add that this addresses the requests make by Jim Schaad and Richard Barnes in JOSE Issues #26 “Allow for signature payload to not be base64 encoded” and #23http://trac.tools.ietf.org/wg/jose/trac/ticket/23 “Make crypto independent of binary encoding (base64)”. Abouthttps://tools.ietf.org/html/draft-jones-jose-key-managed-json-web-signature-01, I’ll add that this addresses the request made by Jim Schaad in JOSE Issue #2http://trac.tools.ietf.org/wg/jose/trac/ticket/2 “No key management for MAC”. Also, there’s a highly relevant discussion about key management for MACs going on in the COSE working group.  See the thread “[Cose] Key management for MACs (was Re: Review of draft-schaad-cose-msg-01)” – especiallyhttps://mailarchive.ietf.org/arch/msg/cose/aUehU6O7Ui8CXcGxy3TquZOxWH4 and https://mailarchive.ietf.org/arch/msg/cose/ouOIdAOe2P-W8BjGLJ7BNvvRr10. One could take the view that our decision on the JOSE key management draft should be informed by the related decision in COSE.  Specifically, that if COSE decides to support key management for MACs, the same reasoning likely should apply to our decision on whether to define a standard mechanism for supporting key management for MACs in JOSE. 
Key management is explicitly out-of-scope for COSE as stated in the charter.  The discussion referenced had this point at the close of that discussion.
I'm not seeing much support for these drafts moving forward in JOSE.  I'm also not seeing enough to justify standards track and AD sponsored.  If you think these are important to have move forward in the WG or as standards track, please say so soon.  They can still go forward through the Independent submission process through the ISE.
Thank you,Kathleen 

                                                            -- Mike From: jose [mailto:[email-masked]]On Behalf Of Karen O'Donoghue
Sent: Wednesday, July 01, 2015 8:38 AM
To: [email-masked]
Subject: [jose] way forward for two remaining drafts Folks,  With the thumbprint draft progressing through the process, we have two remaining individual drafts to decide what to do with. The options include: 1) adopt as working group drafts; 2) ask for AD sponsorship of individual drafts; or 3) recommend that they not be published. Please express your thoughts on what we should do with these drafts. Jim, Kathleen, and I would like to make a decision in the Prague timeframe, so please respond by 15 July.  https://tools.ietf.org/id/draft-jones-jose-jws-signing-input-options-00.txt https://tools.ietf.org/id/draft-jones-jose-key-managed-json-web-signature-01.txt Thanks,Karen

-- 
Nat Sakimura (=nat)Chairman, OpenID Foundation
http://nat.sakimura.org/
@_nat_en
_______________________________________________
jose mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/jose

---

From: Kathleen Moriarty <[email-masked]>
Date: Mon, 13 Jul 2015 14:24:40 -0400

Hello,

It's good too see that a few people do support these drafts.  Will each of you be sending reviews and comments to the list shortly on these drafts?  If the chairs think it's reasonable to accept the drafts, they will also need to know there will be active support.

Thanks,
Kathleen 

Sent from my iPhone

> On Jul 13, 2015, at 1:10 PM, Edmund Jay <[email-masked]> wrote:
> 
> +1
> 
>

---

From: Anders Rundgren <[email-masked]>
Date: Mon, 13 Jul 2015 21:37:34 +0200

On 2015-07-13 20:24, Kathleen Moriarty wrote:
> Hello,
>
> It's good too see that a few people do support these drafts.
 > Will each of you be sending reviews and comments to the list shortly on these drafts?
 > If the chairs think it's reasonable to accept the drafts, they will also need to know
 > there will be active support.

Hello Kathleen,

I intend to review
draft-jones-jose-jws-signing-input-options
and post the result the next coming two weeks.

thanx,
Anders

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Mon, 13 Jul 2015 15:43:05 -0400

I intend to review draft-jones-jose-jws-signing-input-options and post the
results shortly after Prague.

On Mon, Jul 13, 2015 at 2:24 PM, Kathleen Moriarty <
[email-masked]> wrote:

> Hello,
>
> It's good too see that a few people do support these drafts.  Will each of
> you be sending reviews and comments to the list shortly on these drafts?
> If the chairs think it's reasonable to accept the drafts, they will also
> need to know there will be active support.
>
> Thanks,
> Kathleen
>
> Sent from my iPhone
>
>   ------------------------------
>  *From:* Nat Sakimura <[email-masked]>
> *To:* Kathleen Moriarty <[email-masked]>
> *Cc:* Mike Jones <[email-masked]>; Karen O'Donoghue <
> [email-masked]>; "[email-masked]" <[email-masked]>
> *Sent:* Sunday, July 12, 2015 10:32 AM
> *Subject:* Re: [jose] way forward for two remaining drafts
>

---

From: Edmund Jay <[email-masked]>
Date: Mon, 13 Jul 2015 19:50:32 +0000 (UTC)

Time permitting, I may do a review of the specs. 
      From: Kathleen Moriarty <[email-masked]>
 To: Edmund Jay <[email-masked]> 
Cc: Nat Sakimura <[email-masked]>; Mike Jones <[email-masked]>; Karen O'Donoghue <[email-masked]>; "[email-masked]" <[email-masked]> 
 Sent: Monday, July 13, 2015 11:24 AM
 Subject: Re: [jose] way forward for two remaining drafts
   
Hello,
Thanks,Kathleen 

Sent from my iPhone

+1

Best, 
Nat

Hi,

Sent from my iPhone

---

From: "Salvatore D'Agostino" <[email-masked]>
Date: Wed, 15 Jul 2015 16:44:30 -0400

Also very late to the conversations but my feelings align with Phil and Nat.

From: Nat Sakimura [mailto:[email-masked]] 
Sent: Sunday, July 12, 2015 1:32 PM
To: Kathleen Moriarty
Cc: Mike Jones; Karen O'Donoghue; [email-masked]
Subject: Re: [jose] way forward for two remaining drafts

Best, 

Nat

Hi,

Sent from my iPhone

Thank you,

Kathleen 

                                                            -- Mike

Folks, 

Thanks,

Karen

 

-- 

Nat Sakimura (=nat)

---

From: George Fletcher <[email-masked]>
Date: Wed, 15 Jul 2015 18:19:20 -0400

I am also interested in these options and can review the spec. Thanks, 
George

On 7/15/15 4:44 PM, Salvatore D'Agostino wrote:
> *From:*Nat Sakimura [mailto:[email-masked]]
> *Sent:* Sunday, July 12, 2015 1:32 PM
> *To:* Kathleen Moriarty
> *Cc:* Mike Jones; Karen O'Donoghue; [email-masked]
> Like Phil, I do see that draft-jones-jose-jws-signing-input-options 
> sort of thing can be very useful, though I may want to have slightly 
> different way of encoding the things. Being able to do detached 
> signature is quite attractive.
>
> Best,
>
> Nat
>
> 2015-07-10 2:37 GMT+09:00 Kathleen Moriarty 
> <[email-masked] 
> <mailto:[email-masked]>>:
>
> Hi,
>
> Sent from my iPhone
>
>
> On Jul 9, 2015, at 1:16 PM, Mike Jones <[email-masked] 
> <mailto:[email-masked]>> wrote:
>
>     About
>     I’ll add that this addresses the requests make by Jim Schaad and
>     Richard Barnes in JOSE Issues #26 “Allow for signature payload to
>     not be base64 encoded” and #23
>     http://trac.tools.ietf.org/wg/jose/trac/ticket/23 “Make crypto
>     independent of binary encoding (base64)”.
>
>     About
>     I’ll add that this addresses the request made by Jim Schaad in
>     JOSE Issue #2 http://trac.tools.ietf.org/wg/jose/trac/ticket/2 “No
>     key management for MAC”.
>
>     Also, there’s a highly relevant discussion about key management
>     for MACs going on in the COSE working group.  See the thread
>     “[Cose] Key management for MACs (was Re: Review of
>     draft-schaad-cose-msg-01)” – especially
>     One could take the view that our decision on the JOSE key
>     management draft should be informed by the related decision in
>     COSE.  Specifically, that if COSE decides to support key
>     management for MACs, the same reasoning likely should apply to our
>     decision on whether to define a standard mechanism for supporting
>     key management for MACs in JOSE.
>
> charter.  The discussion referenced had this point at the close of 
> that discussion.
>
> I'm not seeing much support for these drafts moving forward in JOSE.  
> I'm also not seeing enough to justify standards track and AD 
> sponsored.  If you think these are important to have move forward in 
> the WG or as standards track, please say so soon.  They can still go 
> forward through the Independent submission process through the ISE.
>
> Thank you,
>
> Kathleen
>
>
>
> -- Mike
>
> *From:*jose [mailto:[email-masked]] *On Behalf Of *Karen O'Donoghue
> *To:* [email-masked] <mailto:[email-masked]>
> remaining individual drafts to decide what to do with. The options 
> include: 1) adopt as working group drafts; 2) ask for AD sponsorship 
> of individual drafts; or 3) recommend that they not be published. 
> Please express your thoughts on what we should do with these drafts. 
> Jim, Kathleen, and I would like to make a decision in the Prague 
> timeframe, so please respond by 15 July.
>

---

From: Prabath Siriwardena <[email-masked]>
Date: Wed, 15 Jul 2015 21:06:57 -0700

I intend to review both the drafts and will post the results here in next
couple of works. ..

Thanks & regards,
-Prabath

-- 
Thanks & Regards,
Prabath

Twitter : @prabath

Mobile : +1 650 625 7950

---

From: Prabath Siriwardena <[email-masked]>
Date: Wed, 15 Jul 2015 21:07:22 -0700

> I intend to review both the drafts and will post the results here in next

works --> weeks

>> It's good too see that a few people do support these drafts.  Will each
>> of you be sending reviews and comments to the list shortly on these
>> drafts?  If the chairs think it's reasonable to accept the drafts, they
>> will also need to know there will be active support.
>>
>> Thanks,
>> Kathleen
>>
>> Sent from my iPhone
>>

-- 
Thanks & Regards,
Prabath

Twitter : @prabath

Mobile : +1 650 625 7950

---

From: <[email-masked]>
Date: Thu, 16 Jul 2015 07:54:36 +0200

Will review and probably implement this.

Nits: s/some of have/some have/
   While this
   cryptographically binds the protected Header Parameters to the
   integrity protected payload, some of have described use cases in
   which this binding is unnecessary and/or an impediment to adoption,
   especially when the payload is large and/or detached.
Should read:

   While this

   cryptographically binds the protected Header Parameters to the

   integrity protected payload, some have described use cases in

   which this binding is unnecessary and/or an impediment to adoption,

   especially when the payload is large and/or detached.

Is it an argument for not base64url encoding payloads that they remain human/developer readable?
This argument would make draft-jones-jose-jws-signing-input-options useful for small payloads too.

-Axel

From: jose [mailto:[email-masked]] On Behalf Of Kathleen Moriarty
Sent: Montag, 13. Juli 2015 20:25
To: Edmund Jay
Cc: Mike Jones; Nat Sakimura; [email-masked]; Karen O'Donoghue
Subject: Re: [jose] way forward for two remaining drafts

Hello,

Thanks,
Kathleen

Sent from my iPhone

On Jul 13, 2015, at 1:10 PM, Edmund Jay <[email-masked]<mailto:[email-masked]>> wrote:
+1

________________________________
From: Nat Sakimura <[email-masked]<mailto:[email-masked]>>
To: Kathleen Moriarty <[email-masked]<mailto:[email-masked]>>
Cc: Mike Jones <[email-masked]<mailto:[email-masked]>>; Karen O'Donoghue <[email-masked]<mailto:[email-masked]>>; "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
Sent: Sunday, July 12, 2015 10:32 AM
Subject: Re: [jose] way forward for two remaining drafts

Best,

Nat

Hi,

Sent from my iPhone

Thank you,
Kathleen

                                                            -- Mike

Folks,

Thanks,
Karen

---

From: hideki nara <[email-masked]>
Date: Thu, 16 Jul 2015 18:49:40 +0900

+1
---
hideki

---

From: "HAYASHI, Tatsuya" <[email-masked]>
Date: Thu, 16 Jul 2015 19:26:22 +0900

+1

I think it's good.

On Thu, Jul 16, 2015 at 6:49 PM, hideki nara <[email-masked]> wrote:
>> <[email-masked]>:
>>>
>>> Hi,
>>>
>>> Sent from my iPhone
>>>
>>> I’ll add that this addresses the request made by Jim Schaad in JOSE Issue #2
>>> http://trac.tools.ietf.org/wg/jose/trac/ticket/2 “No key management for
>>> MAC”.
>>>
>>>
>>>
>>> going on in the COSE working group.  See the thread “[Cose] Key management
>>> for MACs (was Re: Review of draft-schaad-cose-msg-01)” – especially
>>> https://mailarchive.ietf.org/arch/msg/cose/aUehU6O7Ui8CXcGxy3TquZOxWH4 and

-- 
HAYASHI, Tatsuya
Lepidum Co. Ltd.

---

From: "Nat Sakimura" <[email-masked]>
Date: Fri, 17 Jul 2015 15:41:08 +0900

Axel wrote: 

 

Indeed. It is one of my use case – small and I want to keep it readable. 

For the case the headers are not needed to be protected, the readability extends to the headers as well. 

Re: header parameters, for the sake of size, I am inclined to combine “sph” and “b64” to “pb” or something and represent the value as a number. 

So: (Sorry for an HTML table)

"sph"

"b64"

“pb”

true

true

3

false

true

1

true

false

2

false

false

0

-- 

Nat Sakimura < <mailto:[email-masked]> [email-masked]>

Nomura Research Institute, Ltd. 

PLEASE READ:

The information contained in this e-mail is confidential and intended for the named recipient(s) only.

If you are not an intended recipient of this e-mail, you are hereby notified that any review, dissemination, distribution or duplication of this message is strictly prohibited. If you have received this message in error, please notify the sender immediately and delete your copy from your system.

From: jose [mailto:[email-masked]] On Behalf Of [email-masked]
Sent: Thursday, July 16, 2015 2:55 PM
To: [email-masked]; [email-masked]
Cc: [email-masked]; [email-masked]; [email-masked]; [email-masked]
Subject: Re: [jose] way forward for two remaining drafts

   While this

Should read:

   While this

-Axel

From: jose [mailto:[email-masked]] On Behalf Of Kathleen Moriarty
Sent: Montag, 13. Juli 2015 20:25
To: Edmund Jay
Cc: Mike Jones; Nat Sakimura; [email-masked] <mailto:[email-masked]> ; Karen O'Donoghue
Subject: Re: [jose] way forward for two remaining drafts

Hello,

Thanks,

Kathleen 

Sent from my iPhone

On Jul 13, 2015, at 1:10 PM, Edmund Jay <[email-masked] <mailto:[email-masked]> > wrote:

+1

  _____  

From: Nat Sakimura <[email-masked] <mailto:[email-masked]> >
To: Kathleen Moriarty <[email-masked] <mailto:[email-masked]> > 
Cc: Mike Jones <[email-masked] <mailto:[email-masked]> >; Karen O'Donoghue <[email-masked] <mailto:[email-masked]> >; "[email-masked] <mailto:[email-masked]> " <[email-masked] <mailto:[email-masked]> > 
Sent: Sunday, July 12, 2015 10:32 AM
Subject: Re: [jose] way forward for two remaining drafts

Best, 

Nat

2015-07-10 2:37 GMT+09:00 Kathleen Moriarty <[email-masked] <mailto:[email-masked]> >:

Hi,

Sent from my iPhone

On Jul 9, 2015, at 1:16 PM, Mike Jones <[email-masked] <mailto:[email-masked]> > wrote:

Thank you,

Kathleen 

                                                            -- Mike

Folks, 

Thanks,

Karen

 

-- 

Nat Sakimura (=nat)

---

From: Mike Jones <[email-masked]>
Date: Fri, 17 Jul 2015 17:33:46 +0000

Thanks, Nat.  When I wrote the draft, I was intentionally being as clear as possible at first about the semantics by using two separate parameters, while also recognizing that we would probably want to collapse these to a single parameter for brevity.  My thinking was that we could define a “sio” (signing input options) parameter and three or four values for it.  I just hadn’t come up with great names for the values.  (You’re using integers, which are short but non-meaningful values.)

Here’s an initial stab for people to suggest better alternatives to:

"sph"

"b64"

“sio”

true

true

(parameter to be omitted when defaults used)

false

true

“b64o” (base64url encoded payload only)

true

false

“plain” (plaintext payload)

false

false

“min” (plaintext payload and no protected header)

                                                            -- Mike

From: Nat Sakimura [mailto:[email-masked]]
Sent: Thursday, July 16, 2015 11:41 PM
To: [email-masked]; [email-masked]; [email-masked]
Cc: Mike Jones; [email-masked]; [email-masked]
Subject: RE: [jose] way forward for two remaining drafts

Axel wrote:

"sph"

"b64"

“pb”

true

true

3

false

true

1

true

false

2

false

false

0

--
Nat Sakimura <[email-masked]<mailto:[email-masked]>>
Nomura Research Institute, Ltd.

PLEASE READ:

From: jose [mailto:[email-masked]] On Behalf Of [email-masked]<mailto:[email-masked]>
Sent: Thursday, July 16, 2015 2:55 PM
To: [email-masked]<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>
Cc: [email-masked]<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>
Subject: Re: [jose] way forward for two remaining drafts

   While this

-Axel

From: jose [mailto:[email-masked]] On Behalf Of Kathleen Moriarty
Sent: Montag, 13. Juli 2015 20:25
To: Edmund Jay
Cc: Mike Jones; Nat Sakimura; [email-masked]<mailto:[email-masked]>; Karen O'Donoghue
Subject: Re: [jose] way forward for two remaining drafts

Hello,

Thanks,
Kathleen

Sent from my iPhone

Best,

Nat

Hi,

Sent from my iPhone

On Jul 9, 2015, at 1:16 PM, Mike Jones <[email-masked]<mailto:[email-masked]>> wrote:
About https://tools.ietf.org/html/draft-jones-jose-jws-signing-input-options-00<https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2ftools.ietf.org%2fhtml%2fdraft-jones-jose-jws-signing-input-options-00&data=01%7c01%7cMichael.Jones%40microsoft.com%7c38da69e6a267492c07c408d28e72b608%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=uGAAosD5aGeonSPFNfYJnr8Eg8lR%2bYJXY8fmq87w%2f7k%3d>, I’ll add that this addresses the requests make by Jim Schaad and Richard Barnes in JOSE Issues #26 “Allow for signature payload to not be base64 encoded” and #23 http://trac.tools.ietf.org/wg/jose/trac/ticket/23<https://na01.safelinks.protection.outlook.com/?url=http%3a%2f%2ftrac.tools.ietf.org%2fwg%2fjose%2ftrac%2fticket%2f23&data=01%7c01%7cMichael.Jones%40microsoft.com%7c38da69e6a267492c07c408d28e72b608%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=CzGoDiV%2brrDZzEN6gX95zdOkkZENLSHj3m0jqitSDJU%3d> “Make crypto independent of binary encoding (base64)”.

About https://tools.ietf.org/html/draft-jones-jose-key-managed-json-web-signature-01<https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2ftools.ietf.org%2fhtml%2fdraft-jones-jose-key-managed-json-web-signature-01&data=01%7c01%7cMichael.Jones%40microsoft.com%7c38da69e6a267492c07c408d28e72b608%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=76KRQQOO11ElDqxjBNLqfmpCVQUnN%2ffc13lqOmMN1Z8%3d>, I’ll add that this addresses the request made by Jim Schaad in JOSE Issue #2 http://trac.tools.ietf.org/wg/jose/trac/ticket/2<https://na01.safelinks.protection.outlook.com/?url=http%3a%2f%2ftrac.tools.ietf.org%2fwg%2fjose%2ftrac%2fticket%2f2&data=01%7c01%7cMichael.Jones%40microsoft.com%7c38da69e6a267492c07c408d28e72b608%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=8ZukCNBEmC2FAYaqOnXZmy%2ffs7YH0TtKC01aFiR%2fHYI%3d> “No key management for MAC”.

Also, there’s a highly relevant discussion about key management for MACs going on in the COSE working group.  See the thread “[Cose] Key management for MACs (was Re: Review of draft-schaad-cose-msg-01)” – especially https://mailarchive.ietf.org/arch/msg/cose/aUehU6O7Ui8CXcGxy3TquZOxWH4<https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2fmailarchive.ietf.org%2farch%2fmsg%2fcose%2faUehU6O7Ui8CXcGxy3TquZOxWH4&data=01%7c01%7cMichael.Jones%40microsoft.com%7c38da69e6a267492c07c408d28e72b608%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=xXRr%2fMEhBlRzUJCohPEIxrOQBl06BJIbWF4p14i19Wc%3d> and https://mailarchive.ietf.org/arch/msg/cose/ouOIdAOe2P-W8BjGLJ7BNvvRr10<https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2fmailarchive.ietf.org%2farch%2fmsg%2fcose%2fouOIdAOe2P-W8BjGLJ7BNvvRr10&data=01%7c01%7cMichael.Jones%40microsoft.com%7c38da69e6a267492c07c408d28e72b608%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=Wgowj5vYeOBshmm3FoMlIwuuG2qsuHzZ6XUXoVI%2fagk%3d>.

Thank you,
Kathleen

                                                            -- Mike

Folks,

https://tools.ietf.org/id/draft-jones-jose-jws-signing-input-options-00.txt<https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2ftools.ietf.org%2fid%2fdraft-jones-jose-jws-signing-input-options-00.txt&data=01%7c01%7cMichael.Jones%40microsoft.com%7c38da69e6a267492c07c408d28e72b608%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=PQVZxAOr28bkgjwqjjtnN5r%2f%2fB9JEnsd8JGWkdE%2fc1E%3d>

https://tools.ietf.org/id/draft-jones-jose-key-managed-json-web-signature-01.txt<https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2ftools.ietf.org%2fid%2fdraft-jones-jose-key-managed-json-web-signature-01.txt&data=01%7c01%7cMichael.Jones%40microsoft.com%7c38da69e6a267492c07c408d28e72b608%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=JjKwmnM113pD8JBnlLyEUam5O%2fVYeoFdhi%2ff0xgsH5I%3d>

Thanks,
Karen
_______________________________________________
jose mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/jose<https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2fwww.ietf.org%2fmailman%2flistinfo%2fjose&data=01%7c01%7cMichael.Jones%40microsoft.com%7c38da69e6a267492c07c408d28e72b608%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=QToiRUC5bprgKcShT345YDZoEXMsk7YFhJZnWUNUJCc%3d>

_______________________________________________
jose mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/jose<https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2fwww.ietf.org%2fmailman%2flistinfo%2fjose&data=01%7c01%7cMichael.Jones%40microsoft.com%7c38da69e6a267492c07c408d28e72b608%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=QToiRUC5bprgKcShT345YDZoEXMsk7YFhJZnWUNUJCc%3d>

--
Nat Sakimura (=nat)
Chairman, OpenID Foundation
http://nat.sakimura.org/<https://na01.safelinks.protection.outlook.com/?url=http%3a%2f%2fnat.sakimura.org%2f&data=01%7c01%7cMichael.Jones%40microsoft.com%7c38da69e6a267492c07c408d28e72b608%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=FPRICyKxNVxCJjahArzhl0zIXhtTl6mXUDFXCv%2fzXgw%3d>
@_nat_en

_______________________________________________
jose mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/jose<https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2fwww.ietf.org%2fmailman%2flistinfo%2fjose&data=01%7c01%7cMichael.Jones%40microsoft.com%7c38da69e6a267492c07c408d28e72b608%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=QToiRUC5bprgKcShT345YDZoEXMsk7YFhJZnWUNUJCc%3d>

---

From: Matias Woloski <[email-masked]>
Date: Sat, 18 Jul 2015 16:58:45 +0000

I was reading the spec and I think detached signature has certainly a
space, so b64: true/false makes sense to me. However I have to say that I
found a bit strecht the use of sph flag. It sounds to me like a premature
optimization. I would keep it out for now to keep things simple.

On Fri, Jul 17, 2015 at 2:34 PM Mike Jones <[email-masked]>
wrote:

>  Thanks, Nat.  When I wrote the draft, I was intentionally being as clear
> as possible at first about the semantics by using two separate parameters,
> while also recognizing that we would probably want to collapse these to a
> single parameter for brevity.  My thinking was that we could define a “sio”
> (signing input options) parameter and three or four values for it.  I just
> hadn’t come up with great names for the values.  (You’re using integers,
> which are short but non-meaningful values.)
>
>
>
> *"sph"*
> *"b64"*
> *“sio”*
> *From:* Nat Sakimura [mailto:[email-masked]]
> *Sent:* Thursday, July 16, 2015 11:41 PM
> *To:* [email-masked]; [email-masked];
> [email-masked]
> *Cc:* Mike Jones; [email-masked]; [email-masked]
> *Subject:* RE: [jose] way forward for two remaining drafts
>
>
>
> Axel wrote:
>
> Re: header parameters, for the sake of size, I am inclined to combine
> “sph” and “b64” to “pb” or something and represent the value as a number.
>
> *"sph"*
> *"b64"*
> *“pb”*
> Nat Sakimura <[email-masked]>
>
> If you are not an intended recipient of this e-mail, you are hereby
> notified that any review, dissemination, distribution or duplication of
> this message is strictly prohibited. If you have received this message in
> error, please notify the sender immediately and delete your copy from your
> system.
>
>
>
> Behalf Of [email-masked]
>
>
> *Sent:* Thursday, July 16, 2015 2:55 PM
> *To:* [email-masked]; [email-masked]
> *Cc:* [email-masked]; [email-masked]; [email-masked];
> [email-masked]
> Behalf Of *Kathleen Moriarty
> *Sent:* Montag, 13. Juli 2015 20:25
> *To:* Edmund Jay
> *Cc:* Mike Jones; Nat Sakimura; [email-masked]; Karen O'Donoghue
> https://tools.ietf.org/html/draft-jones-jose-jws-signing-input-options-00
> <https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2ftools.ietf.org%2fhtml%2fdraft-jones-jose-jws-signing-input-options-00&data=01%7c01%7cMichael.Jones%40microsoft.com%7c38da69e6a267492c07c408d28e72b608%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=uGAAosD5aGeonSPFNfYJnr8Eg8lR%2bYJXY8fmq87w%2f7k%3d>,
> encoded” and #23 http://trac.tools.ietf.org/wg/jose/trac/ticket/23
> <https://na01.safelinks.protection.outlook.com/?url=http%3a%2f%2ftrac.tools.ietf.org%2fwg%2fjose%2ftrac%2fticket%2f23&data=01%7c01%7cMichael.Jones%40microsoft.com%7c38da69e6a267492c07c408d28e72b608%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=CzGoDiV%2brrDZzEN6gX95zdOkkZENLSHj3m0jqitSDJU%3d>
> “Make crypto independent of binary encoding (base64)”.
>
>
>
> About
> https://tools.ietf.org/html/draft-jones-jose-key-managed-json-web-signature-01
> <https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2ftools.ietf.org%2fhtml%2fdraft-jones-jose-key-managed-json-web-signature-01&data=01%7c01%7cMichael.Jones%40microsoft.com%7c38da69e6a267492c07c408d28e72b608%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=76KRQQOO11ElDqxjBNLqfmpCVQUnN%2ffc13lqOmMN1Z8%3d>,
> #2 http://trac.tools.ietf.org/wg/jose/trac/ticket/2
> <https://na01.safelinks.protection.outlook.com/?url=http%3a%2f%2ftrac.tools.ietf.org%2fwg%2fjose%2ftrac%2fticket%2f2&data=01%7c01%7cMichael.Jones%40microsoft.com%7c38da69e6a267492c07c408d28e72b608%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=8ZukCNBEmC2FAYaqOnXZmy%2ffs7YH0TtKC01aFiR%2fHYI%3d>
> “No key management for MAC”.
>
>
>
> <https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2fmailarchive.ietf.org%2farch%2fmsg%2fcose%2faUehU6O7Ui8CXcGxy3TquZOxWH4&data=01%7c01%7cMichael.Jones%40microsoft.com%7c38da69e6a267492c07c408d28e72b608%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=xXRr%2fMEhBlRzUJCohPEIxrOQBl06BJIbWF4p14i19Wc%3d>
> <https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2fmailarchive.ietf.org%2farch%2fmsg%2fcose%2fouOIdAOe2P-W8BjGLJ7BNvvRr10&data=01%7c01%7cMichael.Jones%40microsoft.com%7c38da69e6a267492c07c408d28e72b608%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=Wgowj5vYeOBshmm3FoMlIwuuG2qsuHzZ6XUXoVI%2fagk%3d>
> .
>
>
>
> <https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2ftools.ietf.org%2fid%2fdraft-jones-jose-jws-signing-input-options-00.txt&data=01%7c01%7cMichael.Jones%40microsoft.com%7c38da69e6a267492c07c408d28e72b608%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=PQVZxAOr28bkgjwqjjtnN5r%2f%2fB9JEnsd8JGWkdE%2fc1E%3d>
>
>
>
>
> <https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2ftools.ietf.org%2fid%2fdraft-jones-jose-key-managed-json-web-signature-01.txt&data=01%7c01%7cMichael.Jones%40microsoft.com%7c38da69e6a267492c07c408d28e72b608%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=JjKwmnM113pD8JBnlLyEUam5O%2fVYeoFdhi%2ff0xgsH5I%3d>
>
>
>
> Thanks,
>
> Karen
>
> <https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2fwww.ietf.org%2fmailman%2flistinfo%2fjose&data=01%7c01%7cMichael.Jones%40microsoft.com%7c38da69e6a267492c07c408d28e72b608%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=QToiRUC5bprgKcShT345YDZoEXMsk7YFhJZnWUNUJCc%3d>
>
>
> <https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2fwww.ietf.org%2fmailman%2flistinfo%2fjose&data=01%7c01%7cMichael.Jones%40microsoft.com%7c38da69e6a267492c07c408d28e72b608%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=QToiRUC5bprgKcShT345YDZoEXMsk7YFhJZnWUNUJCc%3d>
>
>
>
>
>
> --
>
> Nat Sakimura (=nat)
>
> <https://na01.safelinks.protection.outlook.com/?url=http%3a%2f%2fnat.sakimura.org%2f&data=01%7c01%7cMichael.Jones%40microsoft.com%7c38da69e6a267492c07c408d28e72b608%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=FPRICyKxNVxCJjahArzhl0zIXhtTl6mXUDFXCv%2fzXgw%3d>
> @_nat_en
>
>
>
> <https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2fwww.ietf.org%2fmailman%2flistinfo%2fjose&data=01%7c01%7cMichael.Jones%40microsoft.com%7c38da69e6a267492c07c408d28e72b608%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=QToiRUC5bprgKcShT345YDZoEXMsk7YFhJZnWUNUJCc%3d>
>
>
>

---

From: Wendy Seltzer <[email-masked]>
Date: Sun, 19 Jul 2015 23:15:31 -0400

Hi,

I'm sending draft-jones-jose-jws-signing-input-options draft to the W3C
Web Payments Interest Group for reviews, as some participants there have
expressed interest in a more developer-readable method for signed linked
data.

--Wendy

>>> https://tools.ietf.org/id/draft-jones-jose-key-managed-json-web-signature-01.txt
_____________________________________________

-- 
Wendy Seltzer -- [email-masked] +1.617.715.4883 (office)
Policy Counsel and Domain Lead, World Wide Web Consortium (W3C)
http://wendy.seltzer.org/        +1.617.863.0613 (mobile)

---

From: Mike Jones <[email-masked]>
Date: Tue, 21 Jul 2015 12:54:18 +0000

FYI, I've been asked by Rich Salz to give a presentation on draft-jones-jose-jws-signing-input-options<https://tools.ietf.org/html/draft-jones-jose-jws-signing-input-options-00> to the ACME working group, which meets Thursday 1520-1720 in Congress III.  The presentation is attached.  You’re all invited to attend (which *can* be done remotely, per the Remote Participation section of https://www.ietf.org/meeting/93/).

                                                            -- Mike

-----Original Message-----
From: Wendy Seltzer [mailto:[email-masked]]
Sent: Monday, July 20, 2015 5:16 AM
To: Kathleen Moriarty
Cc: Mike Jones; Nat Sakimura; [email-masked]; Karen O'Donoghue
Subject: Re: [jose] way forward for two remaining drafts

Hi,

I'm sending draft-jones-jose-jws-signing-input-options draft to the W3C Web Payments Interest Group for reviews, as some participants there have expressed interest in a more developer-readable method for signed linked data.

--Wendy

>> Cc: Mike Jones <[email-masked]<mailto:[email-masked]>>; Karen O'Donoghue

>> <[email-masked]<mailto:[email-masked]>>; "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>

>>> About https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2ftools.ietf.org%2fhtml%2fdraft-jones-jose-jws-signing-input-options-00%2c&data=01%7c01%7cMichael.Jones%40microsoft.com%7ccf4fbf7c1ae44f7f605e08d290b17ed2%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=YxE6NmUaQ5diKIYxBONO7%2bPOxz6X%2fW9trXmEDaNP4ME%3d I’ll add that this addresses the requests make by Jim Schaad and Richard Barnes in JOSE Issues #26 “Allow for signature payload to not be base64 encoded” and #23 https://na01.safelinks.protection.outlook.com/?url=http%3a%2f%2ftrac.tools.ietf.org%2fwg%2fjose%2ftrac%2fticket%2f23&data=01%7c01%7cMichael.Jones%40microsoft.com%7ccf4fbf7c1ae44f7f605e08d290b17ed2%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=PUcoz6T7G6wFGKglEsrvJTR6CuD7fVSmOmSpfI%2fNcLU%3d “Make crypto independent of binary encoding (base64)”.

>>> About https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2ftools.ietf.org%2fhtml%2fdraft-jones-jose-key-managed-json-web-signature-01%2c&data=01%7c01%7cMichael.Jones%40microsoft.com%7ccf4fbf7c1ae44f7f605e08d290b17ed2%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=i1gON5RevmYKIRp%2ffpa0IUM4mMATz9GzlqJwaZOV8Kw%3d I’ll add that this addresses the request made by Jim Schaad in JOSE Issue #2 https://na01.safelinks.protection.outlook.com/?url=http%3a%2f%2ftrac.tools.ietf.org%2fwg%2fjose%2ftrac%2fticket%2f2&data=01%7c01%7cMichael.Jones%40microsoft.com%7ccf4fbf7c1ae44f7f605e08d290b17ed2%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=TQ8KWP1LnDtnf8qC%2bdQSOvwTEaN2e%2fcOHquXSSskWns%3d “No key management for MAC”.

>>> Also, there’s a highly relevant discussion about key management for

>>> MACs going on in the COSE working group.  See the thread “[Cose] Key

>>> https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2fmai

>>> larchive.ietf.org%2farch%2fmsg%2fcose%2faUehU6O7Ui8CXcGxy3TquZOxWH4&

>>> data=01%7c01%7cMichael.Jones%40microsoft.com%7ccf4fbf7c1ae44f7f605e0

>>> 8d290b17ed2%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=BlB8JqzOTuh

>>> hSYzi7ygO1QJqHZOipOqva8uMEsMzrR4%3d and

>>> https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2fmai

>>> larchive.ietf.org%2farch%2fmsg%2fcose%2fouOIdAOe2P-W8BjGLJ7BNvvRr10.

>>> &data=01%7c01%7cMichael.Jones%40microsoft.com%7ccf4fbf7c1ae44f7f605e

>>> 08d290b17ed2%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=cvpIAhvIo1

>>> eFLaubzc6hC%2bCnAR7YBNR7dVUsVmDtiys%3d

>>> From: jose [mailto:[email-masked]] On Behalf Of Karen

>>> O'Donoghue

>>> https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2ftoo

>>> ls.ietf.org%2fid%2fdraft-jones-jose-jws-signing-input-options-00.txt

>>> &data=01%7c01%7cMichael.Jones%40microsoft.com%7ccf4fbf7c1ae44f7f605e

>>> 08d290b17ed2%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=gVViP9znYo

>>> fwYtoIL%2fhIQC%2f1OQwTLxRtQT8PayvYpi8%3d

>>> https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2ftoo

>>> ls.ietf.org%2fid%2fdraft-jones-jose-key-managed-json-web-signature-0

>>> 1.txt&data=01%7c01%7cMichael.Jones%40microsoft.com%7ccf4fbf7c1ae44f7

>>> f605e08d290b17ed2%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=wIoGj

>>> 1dJzp3QiT0IycqtKLGf0fWoKfrvOlv90a41Xhc%3d

> https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2fwww.i

> etf.org%2fmailman%2flistinfo%2fjose&data=01%7c01%7cMichael.Jones%40mic

> rosoft.com%7ccf4fbf7c1ae44f7f605e08d290b17ed2%7c72f988bf86f141af91ab2d

> 7cd011db47%7c1&sdata=4df%2bwGYpkyLt8fqw6VW3Ea%2bsQLcJhSEkQHp7tWpqYY4%3

> d

--

Wendy Seltzer -- [email-masked]<mailto:[email-masked]> +1.617.715.4883 (office) Policy Counsel and Domain Lead, World Wide Web Consortium (W3C)

https://na01.safelinks.protection.outlook.com/?url=http%3a%2f%2fwendy.seltzer.org%2f&data=01%7c01%7cMichael.Jones%40microsoft.com%7ccf4fbf7c1ae44f7f605e08d290b17ed2%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=KROQCeTKvY0IFOT%2bUGhssnjl2hOROZOalSNNbEFFVXk%3d        +1.617.863.0613 (mobile)

---

From: Karen O'Donoghue <[email-masked]>
Date: Thu, 23 Jul 2015 11:04:12 +0000

Based on the feedback from the working group, the chairs are making the following consensus calls:

There is no jose wg consensus to adopt the following document:
https://tools.ietf.org/id/draft-jones-jose-key-managed-json-web-signature-01.txt

However, there is consensus to adopt the following document:
https://tools.ietf.org/id/draft-jones-jose-jws-signing-input-options-00.txt

We would like to complete this document in the next two months so please read and provide substantive comments as soon as possible.

Regards,
Karen and Jim

On Jul 1, 2015, at 5:37 PM, Karen O'Donoghue <[email-masked]<mailto:[email-masked]>> wrote:

Folks,

Thanks,
Karen