Mike Jones: self-issued

Musings on Digital Identity

Author: Mike Jones Page 21 of 33

Building the Internet's missing identity layer

JOSE -14 and JWT -11 drafts with additional algorithms and examples published

By

On July 29, 2013

In Claims, Cryptography, JSON, OAuth, Specifications

IETF logoJSON Object Signing and Encryption (JOSE) -14 drafts have been published that incorporate minor updates requested by the working group since the last working group call. The primary change was adding algorithm identifiers for AES algorithms using 192 bit keys; supporting these algorithms is optional. The only breaking changes were to the password-based encryption algorithm parameter representation. This version adds an example ECDH-ES Key Agreement computation.

The JSON Web Token (JWT) -11 draft adds a Nested JWT example — in which the claims are first signed, and then encrypted.

The drafts are available at:

HTML formatted versions are also available at:

OpenID Connect Presentation at IETF 87

By

On July 28, 2013

In Events, OpenID

OpenID logoI’ve posted the OpenID Connect presentation that I gave at the OpenID Workshop at IETF 87. Besides giving an overview of the specification status, unsurprisingly given the setting at IETF 87, it also talks about the relationship between OpenID Connect and the IETF specifications that it depends upon. It’s available as PowerPoint and PDF.

JOSE -13 drafts

By

On July 15, 2013

In Cryptography, JSON, Specifications

IETF logoThe JSON Object Signing and Encryption (JOSE) -13 drafts are now available, which incorporate issue resolutions agreed to on today’s JOSE working group call. The only breaking change was to the JWS JSON Serialization, by making all header parameters be per-signature (which is actually a simplification and makes it more parallel to the JWS Compact Serialization). Algorithms were added to JWA for key encryption with AES GCM and for password-based encryption. An optional “aad” (Additional Authenticated Data) member was added to the JWE JSON Serialization.

Thanks to Matt Miller for the password-based encryption write-up, which is based on draft-miller-jose-jwe-protected-jwk-02.

The drafts are available at:

HTML formatted versions are also available at:

OAuth assertions drafts improving interop characteristics

By

On July 15, 2013

In Claims, JSON, OAuth, Specifications

IETF logoUpdated OAuth assertions drafts have been posted that improve their interoperability characteristics in a manner suggested during IESG review: they now state that issuer and audience values should be compared using the Simple String Comparison method defined in Section 6.2.1 of RFC 3986 unless otherwise specified by the application.

The drafts are available at:

HTML formatted versions are available at:

JWT draft -10

By

On July 14, 2013

In Claims, Cryptography, JSON, OAuth, Specifications

IETF logoJSON Web Token (JWT) draft -10 allows Claims to be replicated as Header Parameters in encrypted JWTs as needed by applications that require an unencrypted representation of specific Claims. This draft is available at http://tools.ietf.org/html/draft-ietf-oauth-json-web-token-10, with an HTML formatted version also available at https://self-issued.info/docs/draft-ietf-oauth-json-web-token-10.html.

AES GCM Key Wrapping draft -01

By

On July 14, 2013

In Cryptography, JSON, Specifications

IETF logoI’ve updated the AES GCM Key Wrapping draft to represent the Initialization Vector and Authentication Tag values used as header parameter values so as to be more parallel with their treatment when using AES GCM for content encryption, per working group request. This draft is now available as http://tools.ietf.org/html/draft-jones-jose-aes-gcm-key-wrap-01. It is also available in HTML format at https://self-issued.info/docs/draft-jones-jose-aes-gcm-key-wrap-01.html.

JOSE -12 and JWT -09 drafts released

By

On July 14, 2013

In Claims, Cryptography, JSON, OAuth, Specifications

IETF logoThe -12 JSON Object Signing and Encryption (JOSE) drafts have been released incorporating issue resolutions agreed to on the July 1, 2013 working group call and on the mailing list. Most of the changes were editorial improvements suggested by Jim Schaad and Richard Barnes. Changes included clarifying that the “typ” and “cty” header parameters are for use by applications and don’t affect JOSE processing, replacing the MIME types application/jws, application/jwe, application/jws+json, and application/jwe+json with application/jose and application/jose+json, and relaxing language on JSON parsing when duplicate member names are encountered to allow use of ECMAScript JSON parsers. See the history entries for the full set of changes.

Corresponding changes to the JSON Web Token (JWT) spec were also published in draft -09.

The drafts are available at:

HTML formatted versions are also available at:

OpenID Connect Update Presentation at CIS 2013

By

On July 8, 2013

In Events, OpenID

OpenID logoI’ve posted the OpenID Connect Update presentation that I gave today during the OpenID Workshop at the Cloud Identity Summit 2013. I’ve trimmed down the presentation to be lighter on the “how” and focus more on the “what” and “why”, relative to the one I gave at EIC in May. It’s available in PowerPoint and PDF formats.

Production Release of Microsoft JWT Support

By

On June 13, 2013

In Claims, Cryptography, JSON, Software

Microsoft has released production support for the JSON Web Token (JWT). Read about it in Alex Simons’ release announcement and Vittorio Bertocci’s blog post on the JWT support.

Proposed Second OpenID Connect Implementer’s Drafts Published

By

On June 7, 2013

In Claims, Federation, JSON, OAuth, OpenID, Specifications

OpenID logoToday marks another significant milestone towards completing the OpenID Connect standard. The OpenID Foundation has announced that the 45 day review period for the second set of proposed Implementer’s Drafts has begun. The working group believes that these are stable and complete drafts. They are being proposed as Implementer’s Drafts, rather than Final Specifications at this time, because of the dependencies on some IETF specifications that are still undergoing standardization — primarily the JSON Web Token (JWT) specification and the JSON Object Signing and Encryption (JOSE) specifications underlying it.

An Implementer’s Draft is a stable version of a specification intended for implementation and deployment that provides intellectual property protections to implementers of the specification. These updated drafts are the product of incorporating months of feedback from implementers and reviewers on earlier specification drafts, starting with the previous Implementer’s Drafts, including feedback resulting from several rounds of interop testing. Thanks to all of you who have been working towards the completion of OpenID Connect!

These specifications are available at:

JOSE -11 drafts and JWT -08 released

By

On May 28, 2013

In Claims, Cryptography, JSON, OAuth, Specifications

IETF logoThe -11 drafts of the JSON Object Signing and Encryption (JOSE) specifications have been released that incorporate the changes agreed to at the interim working group meeting last month. Most of the changes were to the JWS and JWE JSON Serialization representations, enabling more flexible treatment of header parameter values. Other changes included removing the Encrypted Key value from the JWE integrity calculation, saying more about key identification, adding key identification parameters to some of the examples, clarifying the use of “kid” values in JWK Sets, enabling X.509 key representations in JWKs, recommending protecting JWKs containing non-public information by encrypting them with JWE, adding “alg” values for RSASSA-PSS, registering additional MIME types, and a number of clarifications. A corresponding -08 JSON Web Token (JWT) spec was also released that updated the encrypted JWT example value to track the JWE change. Hopefully this will be the last breaking change to the encryption calculations.

The specifications are available at:

HTML formatted versions are available at:

OAuth 2.0 has won the 2013 European Identity Award

By

On May 15, 2013

In Events, OAuth, Specifications

OAuth logoI’m pleased to report that OAuth 2.0 has won the 2013 European Identity Award for Best Innovation/New Standard. I was honored to accept the award from Kuppinger Cole at the 2013 European Identity and Cloud Conference on behalf of all who contributed to creating the OAuth 2.0 standards [RFC 6749, RFC 6750] and who are building solutions with them.

EIC 2013 Award Mike Jones EIC 2013 Award Chuck Mortimore, Mike Jones, John Bradley EIC 2013 Award Presentation EIC 2013 Award Acceptance

OpenID Connect Update Presentation

By

On May 14, 2013

In Events, OpenID

OpenID logoI’ve posted the OpenID Connect Update presentation that I gave today during the OpenID Workshop at the European Identity and Cloud Conference. It’s available in PowerPoint and PDF formats.

Fourth Release Candidates for OpenID Connect Implementer’s Drafts

By

On May 4, 2013

In Claims, Events, Federation, JSON, OAuth, OpenID, Specifications

OpenID logoA fourth set of release candidates for the upcoming OpenID Connect Implementer’s Drafts has been released. Changes since the third release candidates mostly consist of editorial improvements. There were only two changes that will result in changes to implementations. The first was replacing the “updated_time” claim, which used a textual date format, with the “updated_at” claim, which uses the same numeric representation as the other OpenID Connect date/time claims. The second was replacing the “PKIX” JWK key type with the “x5c” JWK key member (a change actually made this week by the JOSE working group).

These are ready for discussion at Monday’s in-person OpenID Connect working group meeting. All issues filed have been addressed.

The updated specifications are:

These specifications did not change:

Thanks to all who continued reviewing and implementing the specifications, resulting in the improvements contained in this release. I’ll look forward to seeing many of you on Monday!

Draft -10 of the JOSE Specifications

By

On April 26, 2013

In Cryptography, JSON, Specifications

IETF logoBased upon working group feedback on the -09 drafts, I’ve released an update to the JSON Object Signing and Encryption (JOSE) specifications that changes the processing rules for JWEs encrypted to multiple recipients. The new processing rules enable using AES GCM for multiple-recipient JWE objects. This update makes no changes to the single-recipient case.

The updated specification versions are:

HTML formatted versions are also available at:

JOSE and JWT specs incorporating decisions from IETF 86

By

On April 23, 2013

In Claims, Cryptography, JSON, OAuth, Specifications

IETF logoNew versions of the JSON Object Signing and Encryption (JOSE) specifications JSON Web Signature (JWS), JSON Web Encryption (JWE), JSON Web Key (JWK), and JSON Web Algorithms (JWA) and the JSON Web Token (JWT) specification have been released that incorporate the working group decisions made during and since IETF 86.

The primary new features in these working group drafts are:

  • adding support for private and symmetric keys to JWK and JWA,
  • adding support for JSON Serializations to JWS and JWE,
  • replacing the custom JOSE CBC+HMAC algorithms with ones compatible with those proposed in draft-mcgrew-aead-aes-cbc-hmac-sha2,
  • defining that the default action for header parameters and claims that are not understood is to ignore them, while providing a way to designate that some extension header parameters must be understood.

More details on the changes made can be found in the Document History entries.

The specifications are available at:

HTML formatted versions are also available at:

Tim Bray on ID Tokens

By

On April 9, 2013

In Claims, Documentation, OAuth, OpenID, People

OpenID logoTim Bray has written a post giving his take on what ID Tokens are and why they’re valuable, both for OpenID Connect and beyond. Full of geeky identity goodness…

Updated OAuth Dynamic Client Registration Draft Published

By

On March 29, 2013

In OAuth, Specifications

OAuth logoThanks to Justin Richer for publishing an updated version of the OAuth Dynamic Client Registration specification. This draft adds the internationalization support introduced in the recent OpenID Connect Dynamic Client Registration draft. Justin did the bulk of the editing and I did some editorial work at the end of the process.

The new specification is:

An HTML formatted version is also available at:

Updated OAuth Assertions Drafts Published

By

On March 29, 2013

In Claims, OAuth, Specifications

OAuth logoThanks to Brian Campbell for publishing updated versions of all three OAuth Assertions specifications. These drafts address comments and “discuss” issues from the IESG review of the Assertion Framework specification as well as issues that arose in subsequent discussions and decisions made during IETF 86 in Orlando. Brian did the bulk of the heavy lifting and I added some editorial work at the end of the process.

The documents now have new titles to make the scope of these specifications more explicit. The new titles and links to the documents are:

Assertion Framework for OAuth 2.0 Client Authentication and Authorization Grants

SAML 2.0 Profile for OAuth 2.0 Client Authentication and Authorization Grants

JSON Web Token (JWT) Profile for OAuth 2.0 Client Authentication and Authorization Grants

See http://www.ietf.org/mail-archive/web/oauth/current/msg11213.html or the document History entries for more details on the changes made.

HTML formatted versions are also available at:

Third Release Candidates for OpenID Connect Implementer’s Drafts

By

On March 27, 2013

In Claims, Federation, JSON, OAuth, OpenID, Specifications

OpenID logoA third set of Release Candidates for the pending OpenID Connect Implementer’s Drafts have been released. Like the first set, the second set of Release Candidates, which were published earlier this month, also received thorough review, resulting in a smaller set of additional refinements. The changes primarily made some the claim definitions more precise and provided more guidance on support for multiple languages and scripts.

Were it not for a set of pending changes about to be made to the JSON Object Signing and Encryption (JOSE) specifications, this set of specifications would likely actually be the Implementer’s Drafts. However, the OpenID Connect working group made the decision to have those (non-breaking) JOSE changes be applied before we declare that the Implementer’s Drafts are done. Expect announcements about both the JOSE updates and the OpenID Connect Implementer’s Drafts soon.

The new specifications are:

See the History entries in the specs for more details on the changes made.

Thanks again to all who reviewed and implemented the recent drafts!

Page 21 of 33

Previous

Next

Powered by WordPress & Theme by Anders Norén