Add note about implementations that removed support for "zip" #33
Conversation
yaronf
left a comment
yaronf
left a comment
There was a problem hiding this comment.
I disagree with the premise here: the BCP formally Updates 7519 (and would Update 7516 if we asked for it), and so I don't think we are committed to retain every last feature if we believe it raises security issues.
We are pointing out a security problem with systems and libraries, and I don't think the position "SHOULD NOT compress but still MUST support zip" is consistent.
|
Actually, the BCP doesn't update JWE [RFC 7516]. It's not within our remit to make breaking changes to a spec in another working group. That would need to be done by new spec work in the JOSE working group, with consensus of that working group. It is within our scope to recommend that problematic features not be used. |
|
Checking in on where we are at on this. The updates look good to me. @bc-pi now is the time to make any additional suggestions! |
Fixes #31