Thanks for your comments, Göran. See the updates to the specification in
https://www.ietf.org/archive/id/draft-ietf-jose-fully-specified-algorithms-06.html.
My replies are inline below, prefixed by "Mike>".
-- Mike
From: Göran Selander <[email protected]>
Sent: Thursday, September 5, 2024 1:30 AM
To: [email protected]; [email protected]
Subject: [jose] Re: 2nd WGLC for draft-ietf-jose-fully-specified-algorithms
(Fully Specified Algorithms)
(About target audience: This draft is proposing to deprecate algorithms in the
COSE IANA registry. It would be great if it by default was circulated also on
the COSE WG mailing list to enable a timely discussion among those affected.)
Mike> Agreed
With reference to a previous thread on this topic:
https://www.mail-archive.com/[email protected]/msg03799.html
The term "deprecated" is still used in this draft with a different meaning
compared to RFC8996 and RFC9325. It doesn't help that you in this document
point out that you are using the word with a different meaning that people are
used to, very much fewer people will read this document than those that stumble
on the term used in registries and understand it from other contexts.
Moreover, this overload of terminology is actually unnecessary:
Section 4.4
> The terms "Deprecated" and "Prohibited" as used by JOSE and COSE
> registrations are currently undefined.
So, in fact this provides a unique opportunity to disambiguate and avoid the
otherwise inevitable confusion that will come up over and over again arising
from the use of the same term with different meanings. A number of perfectly
good alternative terms were suggested in the referenced mail thread.
Mike> Yes, there were not definitions of "Deprecated" and "Prohibited"
previously in the specifications, but I will observe that the use of both terms
in RFC 7518 makes the distinction pretty clear in context based on the plain
English meanings of the terms. "Prohibited" means that an algorithm must not
be used. "Deprecated" means that an alternative algorithm should be used, when
possible. The specification clearly and consistently defines both of those
terms in a way that's applicable to both JOSE and COSE.
Mike> Furthermore, and I consider this a big plus. these definitions don't
require any changes to existing JOSE or COSE registrations. Nor do they
require defining new terms that were not already in use. Many of the other
terminology proposals don't share these advantages, which is why we went with
this one. I'll also observe that some reviewers explicitly thanked us for the
clear terminology definitions.
Moreover, for systems that makes use of the COSE IANA registry and specifies
algorithms with enough parameters to make them completely determined, for
example EDHOC cipher suites, there is no need to change or abandon the use of
the current algorithms. Hence the recommendation ("SHOULD") in the definition
does not apply to such systems, and that circumstance should be stated as an
exception to the recommendation.
Mike> We added text describing circumstances in which it makes sense to
continue using deprecated algorithms, per your suggestion.
In summary
* use a different term
* make it clear that current algorithms may be used in case a separate
specification adds the necessary information to make them fully specified
Göran
From: John Mattsson
<[email protected]<mailto:[email protected]>>
Date: Thursday, 22 August 2024 at 11:10
To: [email protected]<mailto:[email protected]> <[email protected]<mailto:[email protected]>>
Subject: [COSE] FW: [jose] 2nd WGLC for
draft-ietf-jose-fully-specified-algorithms (Fully Specified Algorithms)
Forwarding to the COSE list as the document updates both RFC 8152 and RFC 9053.
Cheers,
John
From: Karen ODonoghue <[email protected]<mailto:[email protected]>>
Date: Wednesday, 21 August 2024 at 16:12
To: JOSE WG <[email protected]<mailto:[email protected]>>
Subject: [jose] 2nd WGLC for draft-ietf-jose-fully-specified-algorithms (Fully
Specified Algorithms)
JOSE working group members,
This email initiates a second working group last call for the Fully
Specified Algorithms document:
https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fdraft-ietf-jose-fully-specified-algorithms%2F&data=05%7C02%7Cjohn.mattsson%40ericsson.com%7C4d5ca1448df945ce272908dcc1eb446e%7C92e84cebfbfd47abbe52080c6b87953f%7C0%7C0%7C638598463418037480%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=lC1d%2Bvw9fTh%2FG2brNNztghIYFbp4pnGwjqvfN%2Bbqrn8%3D&reserved=0<https://datatracker.ietf.org/doc/draft-ietf-jose-fully-specified-algorithms/>
The authors have updated the draft based on WGLC comments and
discussions at IETF 120, and the chairs have polled the working group
about the readiness for WGLC. Seeing no opposition, we've decided to
proceed with a second WGLC.
Please review the document in detail and reply to this message
(keeping the subject line intact) with your opinion on the readiness
of this document for publication and any additional comments that you
have.
This will be a three week WGLC. Please submit your responses by 13
September 2024.
Thank you,
Karen (for the JOSE WG chairs)
_______________________________________________
jose mailing list -- [email protected]<mailto:[email protected]>
To unsubscribe send an email to [email protected]<mailto:[email protected]>
_______________________________________________
jose mailing list -- [email protected]
To unsubscribe send an email to [email protected]
