Mike Jones: self-issued

Musings on Digital Identity

Category: Claims Page 6 of 13

OAuth Discovery spec pared down to its essence

By

On February 17, 2016

In Claims, JSON, OAuth, Specifications

OAuth logoIn response to working group input, this version of the OAuth Discovery specification has been pared down to its essence — leaving only the features that are already widely deployed. Specifically, all that remains is the definition of the authorization server discovery metadata document and the metadata values used in it. The WebFinger discovery logic has been removed. The relationship between the issuer identifier URL and the well-known URI path relative to it at which the discovery metadata document is located has also been clarified.

Given that this now describes only features that are in widespread deployment, the editors believe that this version is ready for working group last call.

The specification is available at:

An HTML-formatted version is also available at:

Authentication Method Reference Values spec incorporating adoption feedback

By

On February 11, 2016

In Claims, JSON, OAuth, OpenID, Specifications

OAuth logoThis draft of the Authentication Method Reference Values specification incorporates OAuth working group feedback from the call for adoption. The primary change was to remove the “amr_values” request parameter, so that “amr” values can still be returned as part of an authentication result, but cannot be explicitly requested. Also, noted that OAuth 2.0 is inadequate for authentication without employing appropriate extensions and changed the IANA registration procedure to no longer require a specification.

The specification is available at:

An HTML-formatted version is also available at:

Initial OAuth working group Discovery specification

By

On February 9, 2016

In Claims, JSON, OAuth, Specifications

OAuth logoWe have created the initial working group version of OAuth Discovery based on draft-jones-oauth-discovery-01, with no normative changes.

The specification is available at:

An HTML-formatted version is also available at:

OAuth Discovery metadata values added for revocation, introspection, and PKCE

By

On January 28, 2016

In Claims, JSON, OAuth, Specifications

OAuth logoThe OAuth Discovery specification has been updated to add metadata values for revocation, introspection, and PKCE. Changes were:

  • Added “revocation_endpoint_auth_methods_supported” and “revocation_endpoint_auth_signing_alg_values_supported” for the revocation endpoint.
  • Added “introspection_endpoint_auth_methods_supported” and “introspection_endpoint_auth_signing_alg_values_supported” for the introspection endpoint.
  • Added “code_challenge_methods_supported” for PKCE.

The specification is available at:

An HTML-formatted version is also available at:

Proof-of-Possession Key Semantics for JWTs spec addressing remaining comments

By

On December 18, 2015

In Claims, Cryptography, JSON, OAuth, Specifications

OAuth logoProof-of-Possession Key Semantics for JWTs draft -11 addresses Sec-Dir review comments by Chris Lonvick and ballot comments by Stephen Farrell. This should enable clearing the “point raised” status from yesterday’s IESG telechat and progressing the document to the RFC Editor.

The specification is available at:

An HTML-formatted version is also available at:

Proof-of-Possession Key Semantics for JWTs spec for IESG telechat

By

On December 17, 2015

In Claims, Cryptography, JSON, OAuth, Specifications

OAuth logoProof-of-Possession Key Semantics for JWTs draft -10 was published for consideration on the IESG telechat later today. All changes were editorial and addressed ballot comments by Barry Leiba.

The specification is available at:

An HTML-formatted version is also available at:

Authentication Method Reference Values coordination with OpenID MODRNA

By

On December 15, 2015

In Claims, JSON, OAuth, OpenID, Specifications

OAuth logoAuthentication Method Reference Values draft -04 added the values “face” (facial recognition), “geo” (geolocation), “hwk” (proof-of-possession of a hardware-secured key), “pin” (Personal Identification Number or pattern), and “swk” (proof-of-possession of a software-secured key), and removed the value “pop” (proof-of-possession), based on input from members of the OpenID Foundation MODRNA working group.

The specification is available at:

An HTML formatted version is also available at:

OAuth 2.0 Token Exchange: An STS for the REST of Us

By

On December 14, 2015

In Claims, JSON, OAuth, Specifications

OAuth logoI’m happy to report that a substantially revised OAuth 2.0 Token Exchange draft has been published that enables a broad range of use cases, while still remaining as simple as possible. This draft unifies the approaches taken in the previous working group draft and draft-campbell-oauth-sts, incorporating working group input from the in-person discussions in Prague and mailing list discussions. Thanks to all for your interest in and contributions to OAuth Token Exchange! Brian Campbell deserves special recognition for doing much of the editing heavy lifting for this draft.

The core functionality remains token type independent. That said, new claims are also defined to enable representation of delegation actors in JSON Web Tokens (JWTs). Equivalent claims could be defined for other token types by other specifications.

See the Document History section for a summary of the changes made. Please check it out!

The specification is available at:

An HTML-formatted version is also available at:

CBOR Web Token (CWT) spec for the ACE working group

By

On December 4, 2015

In CBOR, Claims, Cryptography, Specifications

IETF logoAfter input from many interested people, IETF Security Area Director Kathleen Moriarty decided that the right place for the CBOR Web Token (CWT) work is the ACE working group. Today Erik Wahlström posted a new draft of the CBOR Web Token (CWT) specification that is intended for ACE.

This version of the spec references the JSON Web Token (JWT) claim definitions, rather than repeating them, and intentionally only includes equivalents of the claims defined by the JWT spec. Other CWT claims, including those needed by ACE applications, will be defined by other specs and registered in the CWT claims registry.

The specification is available at:

An HTML-formatted version is also available at:

Authentication Method Reference Values Registration Instructions

By

On December 4, 2015

In Claims, JSON, OAuth, OpenID, Specifications

OAuth logoAuthentication Method Reference Values draft -03 adds the criterion to the IANA registration instructions that the value being registered be in actual use.

The specification is available at:

An HTML formatted version is also available at:

Proof-of-Possession Key Semantics for JWTs spec addressing additional AD comments

By

On November 30, 2015

In Claims, Cryptography, JSON, OAuth, Specifications

OAuth logoProof-of-Possession Key Semantics for JWTs draft -08 addresses additional Area Director review comments. A security consideration about utilizing audience restriction in combination with proof-of-possession was added. Thanks to John Bradley for working on the additional wording with me.

The specification is available at:

An HTML formatted version is also available at:

OAuth Discovery

By

On November 25, 2015

In Claims, JSON, OAuth, Specifications

OAuth logoI’m pleased to announce that Nat Sakimura, John Bradley, and I have created an OAuth 2.0 Discovery specification. This fills a hole in the current OAuth specification set that is necessary to achieve interoperability. Indeed, the Interoperability section of OAuth 2.0 states:

In addition, this specification leaves a few required components partially or fully undefined (e.g., client registration, authorization server capabilities, endpoint discovery). Without these components, clients must be manually and specifically configured against a specific authorization server and resource server in order to interoperate.

This framework was designed with the clear expectation that future work will define prescriptive profiles and extensions necessary to achieve full web-scale interoperability.

This specification enables discovery of both endpoint locations and authorization server capabilities.

This specification is based upon the already widely deployed OpenID Connect Discovery 1.0 specification and is compatible with it, by design. The OAuth Discovery spec removes the portions of OpenID Connect Discovery that are OpenID specific and adds metadata values for Revocation and Introspection endpoints. It also maps OpenID concepts, such as OpenID Provider, Relying Party, End-User, and Issuer to their OAuth underpinnings, respectively Authorization Server, Client, Resource Owner, and the newly introduced Configuration Information Location. Some identifiers with names that appear to be OpenID specific were retained for compatibility purposes; despite the reuse of these identifiers that appear to be OpenID specific, their usage in this specification is actually referring to general OAuth 2.0 features that are not specific to OpenID Connect.

The specification is available at:

An HTML-formatted version is also available at:

Proof-of-Possession Key Semantics for JWTs spec addressing Area Director comments

By

On November 24, 2015

In Claims, Cryptography, JSON, OAuth, Specifications

OAuth logoProof-of-Possession Key Semantics for JWTs draft -07 addresses review comments by our Area Director, Kathleen Moriarty, as well as comments by Hannes Tschofenig and Justin Richer. This should hopefully enable IETF last call.

The specification is available at:

An HTML formatted version is also available at:

JWS Unencoded Payload Option spec addressing Area Director comments

By

On November 24, 2015

In Claims, Cryptography, Specifications

IETF logoDraft -06 of the JWS Unencoded Payload Option specification addresses review comments by our Area Director, Kathleen Moriarty. This should hopefully enable IETF last call.

The specification is available at:

An HTML formatted version is also available at:

CBOR Web Token (CWT)

By

On November 12, 2015

In CBOR, Claims, Cryptography, Specifications

IETF logoI know that some of you have been following the IETF’s work on the CBOR Object Signing and Encryption (COSE) Working group on creating a Concise Binary Object Representation (CBOR) equivalent of the JSON-based cryptographic data formats produced by the JSON Object Signing and Encryption (JOSE) Working group. I’m happy to announce that work has now started on a CBOR Web Token (CWT) specification: a CBOR mapping of the JSON Web Token (JWT) security token format that was built using the JOSE specifications. While I expect JSON and the JOSE/JWT specs to continue be used in most Web, PC, phone, tablet, cloud, and enterprise contexts, the COSE specs and now CWT are designed for use in constrained environments, such as those for some Internet of Things (IoT) devices.

Just as it was important to have a JSON-based security token format for applications using JSON, it will be important to have a CBOR-based security token format for applications using CBOR. CBOR Web Token (CWT) fills that role. Note that what is actually defined is a general cryptographically secured CBOR data structure, enabling CWTs to be used as general application payloads for CBOR-based applications.

The abstract of the specification is:

CBOR Web Token (CWT) is a compact means of representing claims to be transferred between two parties. CWT is a profile of the JSON Web Token (JWT) that is optimized for constrained devices. The claims in a CWT are encoded in the Concise Binary Object Representation (CBOR) and CBOR Object Signing and Encryption (COSE) is used for added application layer security protection. A claim is a piece of information asserted about a subject and is represented as a name/value pair consisting of a claim name and a claim value.

My thanks to Erik Wahlström and Hannes Tschofenig for helping to make this happen!

Finally, I’ll note that just as the suggested pronunciation of JWT is the same as the English word “jot”, the suggested pronunciation of CWT is the same as the English word “cot”. So welcome to “cots”!

The specification is available at:

An HTML formatted version is also available at:

Proof-of-Possession Key Semantics for JWTs spec addressing final shepherd comment

By

On November 4, 2015

In Claims, Cryptography, JSON, OAuth, Specifications

OAuth logoProof-of-Possession Key Semantics for JWTs draft -06 addresses the remaining document shepherd comment – adding use case diagrams to the introduction.

The updated specification is available at:

An HTML formatted version is also available at:

Proof-of-Possession Key Semantics for JWTs spec addressing document shepherd comments

By

On October 19, 2015

In Claims, Cryptography, JSON, OAuth, Specifications

OAuth logoProof-of-Possession Key Semantics for JWTs draft -05 addresses Kepeng Li’s document shepherd comments (other than adding some use case diagrams in the introduction, which will happen soon).

The updated specification is available at:

An HTML formatted version is also available at:

Proof-of-Possession Key Semantics for JWTs spec addressing remaining comments

By

On August 28, 2015

In Claims, Cryptography, JSON, OAuth, Specifications

OAuth logoProof-of-Possession Key Semantics for JWTs draft -04 addresses the remaining working group comments received — both a few leftover WGLC comments and comments received during IETF 93 in Prague. The changes were:

  • Allowed the use of “jwk” for symmetric keys when the JWT is encrypted.
  • Added the “jku” (JWK Set URL) member.
  • Added privacy considerations.
  • Reordered sections so that the “cnf” (confirmation) claim is defined before it is used.
  • Noted that applications can define new claim names, in addition to “cnf“, to represent additional proof-of-possession keys, using the same representation as “cnf“.
  • Applied wording clarifications suggested by Nat Sakimura.

The updated specification is available at:

An HTML formatted version is also available at:

“amr” values “rba” and “sc”

By

On August 21, 2015

In Claims, JSON, OAuth, OpenID, Specifications

OAuth logoAuthentication Method Reference Values draft -02 changed the identifier for risk-based authentication from “risk” to “rba“, by popular acclaim, and added the identifier “sc” (smart card).

The specification is available at:

An HTML formatted version is also available at:

“amr” Values spec updated

By

On August 13, 2015

In Claims, JSON, OAuth, OpenID, Specifications

OAuth logoI’ve updated the Authentication Method Reference Values spec to incorporate feedback received from the OAuth working group. Changes were:

  • Added the values “mca” (multiple-channel authentication), “risk” (risk-based authentication), and “user” (user presence test).
  • Added citations in the definitions of Windows integrated authentication, knowledge-based authentication, risk-based authentication, multiple-factor authentication, one-time password, and proof-of-possession.
  • Alphabetized the values.
  • Added Tony Nadalin as an author and added acknowledgements.

The specification is available at:

An HTML formatted version is also available at:

Page 6 of 13

Previous

Next

Powered by WordPress & Theme by Anders Norén