Mike Jones: self-issued

Musings on Digital Identity

Month: April 2014

JOSE -26 and JWT -20 drafts addressing editorial issues

By

On April 30, 2014

In Claims, Cryptography, JSON, Specifications

IETF logoThe JOSE -26 and JWT -20 drafts address a few editorial issues recently identified by reviewers, hopefully further clarifying these aspects of the specifications. No normative changes were made.

See the Document History entries for details on the specific changes made.

The specifications are available at:

HTML formatted versions are also available at:

JSON Web Key (JWK) Thumbprint Specification

By

On April 10, 2014

In Cryptography, JSON, Specifications

IETF logoI created a new simple spec that defines a way to create a thumbprint of an arbitrary key, based upon its JWK representation. The abstract of the spec is:

This specification defines a means of computing a thumbprint value (a.k.a. digest) of JSON Web Key (JWK) objects analogous to the x5t (X.509 Certificate SHA-1 Thumbprint) value defined for X.509 certificate objects. This specification also registers the new JSON Web Signature (JWS) and JSON Web Encryption (JWE) Header Parameters and the new JSON Web Key (JWK) member name jkt (JWK SHA-256 Thumbprint) for holding these values.

The desire for this came up in an OpenID Connect context, but it’s of general applicability, so I decided to submit the spec to the JOSE working group. Thanks to James Manger, John Bradley, and Nat Sakimura for the discussions that led up to this spec.

The specification is available at:

An HTML formatted version is also available at:

Proof-Of-Possession Semantics for JSON Web Tokens (JWTs)

By

On April 1, 2014

In Claims, Cryptography, JSON, OAuth, Specifications

OAuth logoI’ve written a concise Internet-Draft on proof-of-possession for JWTs with John Bradley and Hannes Tschofenig. Quoting from the abstract:

This specification defines how to express a declaration in a JSON Web Token (JWT) that the presenter of the JWT possesses a particular key and that the recipient can cryptographically confirm proof-of-possession of the key by the presenter. This property is also sometimes described as the presenter being a holder-of-key.

This specification intentionally does not specify the means of communicating the proof-of-possession JWT, nor the messages used to exercise the proof key, as these are necessarily application-specific. Rather, this specification defines a proof-of-possession JWT data structure to be used by other specifications that do define those things.

The specification is available at:

An HTML formatted version is available at:

Powered by WordPress & Theme by Anders Norén