Subject: Re: [jose] [Editorial Errata Reported] RFC7520 (4801)

From: Jim Schaad <[email-masked]>
Date: Wed, 4 Dec 2019 12:16:05 -0800

I went through to start getting all of the JOSE errata cleaned out.  After
consulting with Matt, I believe that this errata should be accepted as
editorial - hold for update.

Jim

-----Original Message-----
From: jose <[email-masked]> On Behalf Of RFC Errata System
Sent: Tuesday, September 13, 2016 1:13 AM
To: [email-masked]; [email-masked];
[email-masked]; [email-masked]; [email-masked]
Cc: [email-masked]; [email-masked]; [email-masked]
Subject: [jose] [Editorial Errata Reported] RFC7520 (4801)

The following errata report has been submitted for RFC7520, "Examples of
Protecting Content Using JSON Object Signing and Encryption (JOSE)".

--------------------------------------
You may review the report below and at:
http://www.rfc-editor.org/errata_search.php?rfc=7520&eid=4801

--------------------------------------
Type: Editorial
Reported by: Wrong JSON Flattened Representation <[email-masked]>

Section: 5.7.5

Original Text
-------------
The figure 150 is:

   {
     "protected": "eyJhbGciOiJBMjU2R0NNS1ciLCJpdiI6IktrWVQwR1hfMm
         pIbGZxTl8iLCJraWQiOiIxOGVjMDhlMS1iZmE5LTRkOTUtYjIwNS0yYj
         RkZDFkNDMyMWQiLCJ0YWciOiJrZlBkdVZRM1QzSDZ2bmV3dC0ta3N3Ii
         wiZW5jIjoiQTEyOENCQy1IUzI1NiJ9",
     "encrypted_key": "lJf3HbOApxMEBkCMOoTnnABxs_CvTWUmZQ2ElLvYNo
         k",
     "iv": "gz6NjyEFNm_vm8Gj6FwoFQ",
     "ciphertext": "Jf5p9-ZhJlJy_IQ_byKFmI0Ro7w7G1QiaZpI8OaiVgD8E
         qoDZHyFKFBupS8iaEeVIgMqWmsuJKuoVgzR3YfzoMd3GxEm3VxNhzWyW
         tZKX0gxKdy6HgLvqoGNbZCzLjqcpDiF8q2_62EVAbr2uSc2oaxFmFuIQ
         HLcqAHxy51449xkjZ7ewzZaGV3eFqhpco8o4DijXaG5_7kp3h2cajRfD
         gymuxUbWgLqaeNQaJtvJmSMFuEOSAzw9Hdeb6yhdTynCRmu-kqtO5Dec
         4lT2OMZKpnxc_F1_4yDJFcqb5CiDSmA-psB2k0JtjxAj4UPI61oONK7z
         zFIu4gBfjJCndsZfdvG7h8wGjV98QhrKEnR7xKZ3KCr0_qR1B-gxpNk3
         xWU",
     "tag": "NvBveHr_vonkvflfnUrmBQ"
   }

But the figure 147 indicates the tag is "DKW7jrb4WaRSNfbXVPlT5g".

Corrected Text
--------------
The figure 150 should be:

   {
     "protected": "eyJhbGciOiJBMjU2R0NNS1ciLCJpdiI6IktrWVQwR1hfMm
         pIbGZxTl8iLCJraWQiOiIxOGVjMDhlMS1iZmE5LTRkOTUtYjIwNS0yYj
         RkZDFkNDMyMWQiLCJ0YWciOiJrZlBkdVZRM1QzSDZ2bmV3dC0ta3N3Ii
         wiZW5jIjoiQTEyOENCQy1IUzI1NiJ9",
     "encrypted_key": "lJf3HbOApxMEBkCMOoTnnABxs_CvTWUmZQ2ElLvYNo
         k",
     "iv": "gz6NjyEFNm_vm8Gj6FwoFQ",
     "ciphertext": "Jf5p9-ZhJlJy_IQ_byKFmI0Ro7w7G1QiaZpI8OaiVgD8E
         qoDZHyFKFBupS8iaEeVIgMqWmsuJKuoVgzR3YfzoMd3GxEm3VxNhzWyW
         tZKX0gxKdy6HgLvqoGNbZCzLjqcpDiF8q2_62EVAbr2uSc2oaxFmFuIQ
         HLcqAHxy51449xkjZ7ewzZaGV3eFqhpco8o4DijXaG5_7kp3h2cajRfD
         gymuxUbWgLqaeNQaJtvJmSMFuEOSAzw9Hdeb6yhdTynCRmu-kqtO5Dec
         4lT2OMZKpnxc_F1_4yDJFcqb5CiDSmA-psB2k0JtjxAj4UPI61oONK7z
         zFIu4gBfjJCndsZfdvG7h8wGjV98QhrKEnR7xKZ3KCr0_qR1B-gxpNk3
         xWU",
     "tag": "DKW7jrb4WaRSNfbXVPlT5g"
   }

Notes
-----

Instructions:
-------------
This erratum is currently posted as "Reported". If necessary, please use
"Reply All" to discuss whether it should be verified or rejected. When a
decision is reached, the verifying party (IESG) can log in to change the
status and edit the report, if necessary. 

--------------------------------------
RFC7520 (draft-ietf-jose-cookbook-08)
--------------------------------------
Title               : Examples of Protecting Content Using JSON Object
Signing and Encryption (JOSE)
Publication Date    : May 2015
Author(s)           : M. Miller
Category            : INFORMATIONAL
Source              : Javascript Object Signing and Encryption
Area                : Security
Stream              : IETF
Verifying Party     : IESG

_______________________________________________
jose mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/jose

---

From: Benjamin Kaduk <[email-masked]>
Date: Mon, 9 Dec 2019 09:26:57 -0800

Hi Jim,

I started looking at this, but I can't find an errata report with eid 4801;
there is https://www.rfc-editor.org/verify_errata_select.php?eid=4802 which
looks quite similar to what is quoted below (but includes additional
commentary in both the old and new text boxes :(

Can you please check that eid 4802 is the content you want us to be
handling?

Thanks,

Ben

---

From: Jim Schaad <[email-masked]>
Date: Mon, 9 Dec 2019 20:22:49 -0800

Sorry - typo on my part - should be 4802.   BUT NOT MY FAULT.  You will
notice that the link in the errata below has the wrong number in it.

-----Original Message-----
From: Benjamin Kaduk <[email-masked]> 
Sent: Monday, December 9, 2019 9:27 AM
To: Jim Schaad <[email-masked]>
Cc: 'RFC Errata System' <[email-masked]>; [email-masked];
Roman Danyliw <[email-masked]>; 'Matthew A. Miller'
<[email-masked]>; [email-masked]; [email-masked]
Subject: Re: [jose] [Editorial Errata Reported] RFC7520 (4801)

Hi Jim,

Thanks,

Ben

On Wed, Dec 04, 2019 at 12:16:05PM -0800, Jim Schaad wrote:
> I went through to start getting all of the JOSE errata cleaned out.  
> After consulting with Matt, I believe that this errata should be 
> accepted as editorial - hold for update.
> 
> Jim
> 
> 
> The following errata report has been submitted for RFC7520, "Examples 
> of Protecting Content Using JSON Object Signing and Encryption (JOSE)".
> 
> This erratum is currently posted as "Reported". If necessary, please 
> use "Reply All" to discuss whether it should be verified or rejected. 
> When a decision is reached, the verifying party (IESG) can log in to 
> change the status and edit the report, if necessary.
>

---

From: Alice Russo <[email-masked]>
Date: Tue, 10 Dec 2019 09:32:28 -0800

Hi Jim, 

Re:
> BUT NOT MY FAULT.  You will

It appears that what happened is:
There was a more-detailed report (EID 4802), which was submitted directly after EID 4801. We deleted EID 4801 (essentially a duplicate). We sent a notification at that time, and asked in the future to please notify the RFC Editor to correct an existing report, rather than file a new report. [Mail from Megan Ferguson, 13 September 2016.]

Anyway; the relevant report is:
https://www.rfc-editor.org/errata/eid4802

(We have corrected the submitter name to Florent Morselli and moved the other text to the notes.)

Thank you.
RFC Editor/ar

> On Dec 9, 2019, at 8:22 PM, Jim Schaad <[email-masked]> wrote:
>