Joel - thank you very much for the review. And thanks for Addressing the issues, Mike.
Jari On 07 Jul 2015, at 00:31, Joel M. Halpern <[email protected]> wrote: > That would work for me. It gets in the point that the comparing entity, as > well as the generating entity, needs to plan for this. > > Thank you, > Joel > > On 7/6/15 6:29 PM, Mike Jones wrote: >> Hi Joel. Thanks for looking this over again. Section 3.4 was added >> in response to Adam Montville's SecDir comments, in which his focus >> was on cases where the hash function didn't have to be known to >> multiple parties. I guess it's only fair that you focus on the cases >> where it does. ;-) >> >> Currently the case you're interested in is covered by the last >> sentence in 3.4, which reads: "Only if multiple parties will be >> reproducing the JWK Thumbprint calculation for some reason, will >> parties other than the original producer of the JWK Thumbprint need >> to know which hash function was used." >> >> I could strength this by making it its own paragraph, saying this: >> "However, in some cases multiple parties will be reproducing the JWK >> Thumbprint calculation and comparing the results. In these cases, >> the parties will need to know which hash function was used and use >> the same one." >> >> Would that work for you, or do you have alternative wording to >> suggest? >> >> Thanks again, -- Mike >> >> -----Original Message----- From: Joel Halpern >> [mailto:[email protected]] Sent: Monday, July 06, 2015 6:18 AM To: >> A. Jean Mahoney; General Area Review Team; >> [email protected] Subject: Re: >> [Gen-art] review: draft-ietf-jose-jwk-thumbprint-05 >> >> The document is nearly ready for publication as a Proposed Standard. >> >> Upon re-review, the addition of section 3.4 raises a question of >> clarity. As written, the text says that the hash function matters >> only to the original thumbprint provider. Should there be a little >> bit of text talking about the need for the hash function to be the >> same for thumbprints to be comparable, or, phrased alternatively, >> that thumbprints with different hashes must not be compared? If >> there were no need for consistent production of the thumbprint, there >> would be no need for a Proposed Standard for the document. >> >> Yours, Joel >> >> The new section 3.4 On 6/19/15 12:06 PM, Joel M. Halpern wrote: >>> I am the assigned Gen-ART reviewer for this draft. For background >>> on Gen-ART, please see the FAQ at >>> >>> <http://wiki.tools.ietf.org/area/gen/trac/wiki/GenArtfaq>. >>> >>> Please resolve these comments along with any other Last Call >>> comments you may receive. >>> >>> Document: draft-ietf-jose-jwk-thumbprint-05 JSON Web Key (JWK) >>> Thumbprint Reviewer: Joel M. Halpern Review Date: 19-June-2015 IETF >>> LC End Date: N/A IESG Telechat date: N/A >>> >>> Summary: The internet draft is ready for publication as a Proposed >>> Standard. >>> >>> [Note to readers: This review is provided because the spreadsheet >>> said so. The draft appears not to be in last call yet. Also, this >>> reviewer did not attempt to second-guess the design choices made by >>> the WG. The choices are well-explain, and I understand it to be >>> the WGs job to make them.] >>> >>> Major issues: N/A >>> >>> Minor issues: N/A >>> >>> Nits/editorial comments: N/A >>> >>> _______________________________________________ Gen-art mailing >>> list [email protected] >>> https://www.ietf.org/mailman/listinfo/gen-art >>> >> > > _______________________________________________ > Gen-art mailing list > [email protected] > https://www.ietf.org/mailman/listinfo/gen-art
signature.asc
Description: Message signed with OpenPGP using GPGMail
_______________________________________________ Gen-art mailing list [email protected] https://www.ietf.org/mailman/listinfo/gen-art
