<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><div>I agree with Brian. "none" is acceptable if the token is exchanged via backchannel</div><div><br></div><div>So I prefer 2 or 3.</div><div><br></div><div>regards,</div><div>Torsten.</div><div><br>Am 27.06.2013 um 01:10 schrieb Mike Jones <<a href="mailto:Michael.Jones@microsoft.com">Michael.Jones@microsoft.com</a>>:<br><br></div><blockquote type="cite"><div>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Tahoma","sans-serif";}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">What do others think? I understand what Brian is saying but I’m not sure that we want to give OPs permission to ever not sign ID Tokens.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">The choices before us seem to be:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">1. Clarify that “none” is never an acceptable “alg” value.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">2. Change the specs to say that “none” may be supported by some OPs and limiting the circumstances under which they may do so.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">3. Change the specs to say that OPs are required to support “none” under specific circumstances.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">I think I could personally live with either 1 or 2 and prefer 1. I don’t think I can agree for us to do 3.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">I think that 1 is the most straightforward thing to do and doesn’t impose any significant implementation burden. Remember that as a design philosophy, we’re
consciously moving complexity away from clients and pushing it to servers, when such tradeoffs arise. This seems like such a case. By requiring that OPs always sign the ID tokens they issue, Clients can always decide to check the signature. They don’t have
to deal with the case where they might not be able to check a signature because none is present. And it’s really not hard for the server to just sign it. So I don’t see any practical value in not signing the token.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">But again, it would be good to hear from a lot of other people on this issue.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"> -- Mike<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> Brian Campbell [<a href="mailto:bcampbell@pingidentity.com">mailto:bcampbell@pingidentity.com</a>]
<br>
<b>Sent:</b> Wednesday, June 26, 2013 2:47 PM<br>
<b>To:</b> Mike Jones<br>
<b>Cc:</b> <a href="mailto:openid-specs-ab@lists.openid.net">openid-specs-ab@lists.openid.net</a><br>
<b>Subject:</b> Re: [Bitbucket] Issue #851: Messages 2.1.2.1 - Clarify that "none" is not an acceptable signature algorithm (openid/connect)<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><o:p> </o:p></p>
<div>
<p class="MsoNormal">On Tue, Jun 25, 2013 at 10:07 AM, Mike Jones <<a href="mailto:Michael.Jones@microsoft.com" target="_blank">Michael.Jones@microsoft.com</a>> wrote:<o:p></o:p></p>
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">It’s a breaking change because clients currently conforming to Messages that always verify the ID
Token signature would break if no signature is contained in the ID Token.</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"> </span><o:p></o:p></p>
</div>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">And any such client would already be registered or configured for one of the other algorithms and wouldn't receive a token with the "none" algorithm. That breaking change situation wouldn't occur.
<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><br>
<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">“none” is not a signature algorithm. JWS and JWA are clear that this results in an unsigned, “plaintext
JWS”, and JWT is clear that this results in a “plaintext JWT” – not a signed JWT. Messages requires that ID Tokens be signed. Sending an unsigned ID Token doesn’t fulfill this requirement.</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"> </span>
<o:p></o:p></p>
</div>
</div>
</blockquote>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">This bug is about making the current meaning of the text – that ID Tokens must be signed – even more
clear, so that developers who aren’t reading JWS closely won’t make the mistake of thinking that just because “none” can be used to create a JWS, that the resulting JWS is signed. (Apparently you were one such developer – making the need for this clarification
all the more evident. </span><span style="font-size:11.0pt;font-family:Wingdings;color:#1F497D">J</span><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">)</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"> </span><o:p></o:p></p>
</div>
</div>
</blockquote>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt">I guess we agree that it's not at all clear as it currently written. Yes "none" is different than the other algorithms but I'd say that line of reasoning is a slippery slope. Messages 2.1.2.1., for example,
says that the ID Token must be signed thereby providing non-repudiation, "ID Tokens MUST be signed using JWS [JWS] and OPTIONALLY both signed and then encrypted using JWS [JWS] and JWE [JWE] respectively, thereby providing authentication, integrity, non-repudiation,
and optionally, confidentiality, per Section 9.13." But the HMAC algorithms aren't signature algorithms either and certainly don't provide non-repudiation. So they shouldn't be acceptable algorithms either, right?
<br>
<br>
I realize it's probably futile to argue but what I'm saying is that it is a reasonable thing to use "none" when the token is sent only via the TLS protected back-channel. And given that I'm "one such developer," I've now got publicly released software that
does allow "none" in that situation where it does make sense. <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><o:p> </o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"> </span><o:p></o:p></p>
<div>
<div style="border:none;border-top:solid windowtext 1.0pt;padding:3.0pt 0in 0in 0in;border-color:-moz-use-text-color -moz-use-text-color">
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> Brian Campbell [mailto:<a href="mailto:issues-reply@bitbucket.org" target="_blank">issues-reply@bitbucket.org</a>]
<br>
<b>Sent:</b> Tuesday, June 25, 2013 7:58 AM<br>
<b>To:</b> Mike Jones<br>
<b>Subject:</b> Re: [Bitbucket] Issue #851: Messages 2.1.2.1 - Clarify that "none" is not an acceptable signature algorithm (openid/connect)</span><o:p></o:p></p>
</div>
</div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" width="100%" style="width:100.0%;border-collapse:collapse">
<tbody>
<tr>
<td style="background:whitesmoke;padding:7.5pt 7.5pt 0in 7.5pt;background-attachment:scroll;background-position-x:0%;background-position-y:0%">
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" width="100%" style="width:100.0%;border-collapse:collapse">
<tbody>
<tr>
<td style="padding:0in 0in 0in 0in">
<div style="border:solid #CCCCCC 1.0pt;padding:15.0pt 15.0pt 15.0pt 15.0pt;border-radius:5px 5px 5px 5px">
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" width="100%" style="width:100.0%;border-collapse:collapse">
<tbody>
<tr>
<td style="padding:0in 0in 0in 0in">
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" width="100%" style="width:100.0%;border-collapse:collapse">
<tbody>
<tr>
<td width="32" valign="top" style="width:24.0pt;padding:0in 0in 0in 0in">
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:10.5pt;font-family:"Arial","sans-serif""><img border="0" width="32" height="32" id="_x0000_i1025" src="https://secure.gravatar.com/avatar/367fabfeed0cee640ce963c0f84f2da5?d=https%3A%2F%2Fd3oaxc4q5k2d6q.cloudfront.net%2Fm%2Fa649696e8dec%2Fimg%2Fdefault_avatar%2F32%2Fuser_blue.png&s=32" alt="b_d_c"></span><o:p></o:p></p>
</td>
<td style="padding:0in 0in 0in 7.5pt">
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" width="100%" style="width:100.0%;border-collapse:collapse">
<tbody>
<tr>
<td colspan="2" style="padding:0in 0in 0in 0in">
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><b><span style="font-size:10.5pt;font-family:"Arial","sans-serif"">Brian Campbell</span></b><span style="font-size:10.5pt;font-family:"Arial","sans-serif""> commented on issue #851:
</span><o:p></o:p></p>
</td>
</tr>
<tr>
<td colspan="2" style="padding:3.75pt 0in 0in 0in">
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><b><span style="font-size:10.5pt;font-family:"Arial","sans-serif""><a href="https://bitbucket.org/openid/connect/issue/851/messages-2121-clarify-that-none-is-not-an" target="_blank"><span style="color:#3B73AF;text-decoration:none">Messages
2.1.2.1 - Clarify that "none" is not an acceptable signature algorithm</span></a>
</span></b><o:p></o:p></p>
</td>
</tr>
<tr>
<td colspan="2" style="padding:7.5pt 0in 11.25pt 0in">
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-size:10.5pt;font-family:"Arial","sans-serif"">I disagree.
</span><o:p></o:p></p>
<p style="margin-bottom:0in;margin-bottom:.0001pt"><span style="font-size:10.5pt;font-family:"Arial","sans-serif"">How would that be a breaking change? If a client is currently configured/registered for RS/EC/HS signature, how would allowing none as a different
option be a breaking change? </span><o:p></o:p></p>
<p style="margin-bottom:0in;margin-bottom:.0001pt"><span style="font-size:10.5pt;font-family:"Arial","sans-serif"">Our implementation currently does allow none as an option (it will only send such an ID Token via the back-channel). Which is, I'll argue, a perfectly
reasonable interpretation of what's been written. So explicitly disallowing it is a breaking for us.
</span><o:p></o:p></p>
</td>
</tr>
<tr>
<td style="padding:7.5pt 0in 0in 0in"></td>
<td style="padding:7.5pt 0in 0in 0in"></td>
</tr>
</tbody>
</table>
</td>
</tr>
</tbody>
</table>
</td>
</tr>
<tr>
<td style="border:none;border-top:solid windowtext 1.0pt;padding:7.5pt 0in 0in 0in;border-color:-moz-use-text-color -moz-use-text-color">
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:10.5pt;font-family:"Arial","sans-serif""><a href="https://bitbucket.org/openid/connect/issue/851/messages-2121-clarify-that-none-is-not-an" target="_blank"><span style="color:#3B73AF;text-decoration:none">View
this issue</span></a> or add a comment by replying to this email. </span><o:p></o:p></p>
</td>
</tr>
</tbody>
</table>
</div>
</td>
</tr>
<tr>
<td style="padding:15.0pt 0in 15.0pt 0in">
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" width="100%" style="width:100.0%;border-collapse:collapse">
<tbody>
<tr>
<td style="padding:0in 0in 0in 0in">
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><a href="https://bitbucket.org/openid/connect/issue/851/unwatch/mbj/f843d56eb7066d599d3972aaab0b00d200d1d4b4/" target="_blank"><span style="color:#3B73AF;text-decoration:none">Unwatch
this issue</span></a> to stop receiving email updates. <o:p></o:p></p>
</td>
<td style="padding:0in 0in 0in 0in"></td>
<td width="100" style="width:75.0pt;padding:0in 0in 0in 0in">
<p class="MsoNormal" align="right" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;text-align:right">
<a href="https://bitbucket.org" target="_blank"><span style="color:#3B73AF;text-decoration:none"><img border="0" width="100" height="18" id="_x0000_i1026" src="https://d3oaxc4q5k2d6q.cloudfront.net/m/a649696e8dec/img/email/logo.gif" alt="Bitbucket"></span></a><o:p></o:p></p>
</td>
</tr>
</tbody>
</table>
</td>
</tr>
</tbody>
</table>
</td>
</tr>
</tbody>
</table>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
</div>
</div>
</blockquote>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</div>
</div></blockquote><blockquote type="cite"><div><span>_______________________________________________</span><br><span>Openid-specs-ab mailing list</span><br><span><a href="mailto:Openid-specs-ab@lists.openid.net">Openid-specs-ab@lists.openid.net</a></span><br><span><a href="http://lists.openid.net/mailman/listinfo/openid-specs-ab">http://lists.openid.net/mailman/listinfo/openid-specs-ab</a></span><br></div></blockquote></body></html>