December 28, 2012
December 27, 2012 JOSE Release

IETF logoNew versions of the JOSE specs have been released incorporating feedback since IETF 85 in Atlanta. The highlight of this release is the new JSON Private and Symmetric Key spec, which extends JWKs to be able to represent private and symmetric keys. These sensitive keys can then be protected for transmission and storage by JWE encryption of their JWK representations.

One new feature added to JWK is the ability to optionally specify which specific algorithm the key is intended to be used with. (This is already existing practice for keys in X.509 format.) For instance, a symmetric key might be annotated to say that it is to be used with the “HS256” algorithm. Because the natural field name for this functionality is “alg”, the “alg” name is now used for this purpose (matching JWS and JWE) and the key type (formerly “alg”) is now denoted by the “kty” field.

This release incorporates editorial improvements suggested by Jeff Hodges and Hannes Tschofenig in their reviews of the JWT specification. Many of these simplified the terminology usage. See the Document History section of each specification for more details about the changes made.

This release is part of a coordinated release of JOSE, OAuth, and OpenID Connect specifications. You can read about the other releases here: OAuth Release Notes, OpenID Connect Release Notes.

The new specification versions are:

HTML formatted versions are available at:

3 Responses to “December 27, 2012 JOSE Release”

  1. Mike Jones: self-issued » December 27, 2012 OAuth JWT & Assssertions Release on 28 Dec 2012 at 4:50 pm #

    [...] December 27, 2012 JOSE Release December 27, 2012 OpenID Connect Release » December 28, 2012 December 27, 2012 OAuth JWT [...]

  2. Mike Jones: self-issued » December 27, 2012 OpenID Connect Release on 28 Dec 2012 at 5:01 pm #

    [...] of JOSE, OAuth, and OpenID Connect specifications. You can read about the other releases here: JOSE Release Notes, OAuth Release [...]

  3. IETF JOSE, OAuth JWT and Assertions, and OpenID Connect spec releases | Backfill for 'Note to Self' on 30 Dec 2012 at 10:18 pm #

    [...] http://t.co/HL3wPBr9 -> here [...]

Trackback URI | Comments RSS

Leave a Reply

You must be logged in to post a comment.