IETF Logo Mail Archive

[jose] JSON Web Key (JWK) Thumbprint Specification

Mike Jones <Michael.Jones@microsoft.com> Fri, 11 April 2014 00:50 UTC

Return-Path: <Michael.Jones@microsoft.com>
X-Original-To: jose@ietfa.amsl.com
Delivered-To: jose@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A1FD11A03A4 for <jose@ietfa.amsl.com>; Thu, 10 Apr 2014 17:50:26 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.601
X-Spam-Level:
X-Spam-Status: No, score=-2.601 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KPn7qnTcz463 for <jose@ietfa.amsl.com>; Thu, 10 Apr 2014 17:50:11 -0700 (PDT)
Received: from na01-by2-obe.outbound.protection.outlook.com (mail-by2lp0242.outbound.protection.outlook.com [207.46.163.242]) by ietfa.amsl.com (Postfix) with ESMTP id E478D1A03A6 for <jose@ietf.org>; Thu, 10 Apr 2014 17:50:10 -0700 (PDT)
Received: from BY2PR03CA033.namprd03.prod.outlook.com (10.242.234.154) by BY2PR03MB173.namprd03.prod.outlook.com (10.242.36.139) with Microsoft SMTP Server (TLS) id 15.0.918.8; Fri, 11 Apr 2014 00:50:08 +0000
Received: from BN1BFFO11FD047.protection.gbl (2a01:111:f400:7c10::1:118) by BY2PR03CA033.outlook.office365.com (2a01:111:e400:2c2c::26) with Microsoft SMTP Server (TLS) id 15.0.908.10 via Frontend Transport; Fri, 11 Apr 2014 00:50:08 +0000
Received: from mail.microsoft.com (131.107.125.37) by BN1BFFO11FD047.mail.protection.outlook.com (10.58.145.2) with Microsoft SMTP Server (TLS) id 15.0.918.6 via Frontend Transport; Fri, 11 Apr 2014 00:50:07 +0000
Received: from TK5EX14MBXC286.redmond.corp.microsoft.com ([169.254.1.232]) by TK5EX14HUBC101.redmond.corp.microsoft.com ([157.54.7.153]) with mapi id 14.03.0181.007; Fri, 11 Apr 2014 00:49:35 +0000
From: Mike Jones <Michael.Jones@microsoft.com>
To: "jose@ietf.org" <jose@ietf.org>
Thread-Topic: JSON Web Key (JWK) Thumbprint Specification
Thread-Index: Ac9VH+RUhqq5I/+bRIOzExN4Xqv18A==
Date: Fri, 11 Apr 2014 00:49:33 +0000
Message-ID: <4E1F6AAD24975D4BA5B16804296739439A150468@TK5EX14MBXC286.redmond.corp.microsoft.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-originating-ip: [157.54.51.34]
Content-Type: multipart/alternative; boundary="_000_4E1F6AAD24975D4BA5B16804296739439A150468TK5EX14MBXC286r_"
MIME-Version: 1.0
X-EOPAttributedMessage: 0
X-Forefront-Antispam-Report: CIP:131.107.125.37; CTRY:US; IPV:CAL; IPV:NLI; EFV:NLI; SFV:NSPM; SFS:(10009001)(438001)(199002)(189002)(84326002)(97736001)(2009001)(83072002)(16297215004)(15975445006)(20776003)(84676001)(79102001)(50986999)(54356999)(2656002)(80022001)(92566001)(15202345003)(66066001)(44976005)(85806002)(85852003)(87936001)(83322001)(512954002)(92726001)(77982001)(80976001)(86612001)(31966008)(19580395003)(6806004)(4396001)(46102001)(16236675002)(86362001)(99396002)(55846006)(19300405004)(81342001)(71186001)(74502001)(76482001)(33656001)(74662001)(81542001)(6606295002); DIR:OUT; SFP:1101; SCL:1; SRVR:BY2PR03MB173; H:mail.microsoft.com; FPR:A04270B0.ACF077DA.25E01769.4CEC354D.20215; PTR:InfoDomainNonexistent; A:1; MX:1; LANG:en;
X-O365ENT-EOP-Header: Message processed by - O365_ENT: Allow from ranges (Engineering ONLY)
X-Forefront-PRVS: 0178184651
Received-SPF: Pass (: domain of microsoft.com designates 131.107.125.37 as permitted sender) receiver=; client-ip=131.107.125.37; helo=mail.microsoft.com;
X-OriginatorOrg: microsoft.onmicrosoft.com
Archived-At: http://mailarchive.ietf.org/arch/msg/jose/-s5Zo6aDwisTrqlqvdasVfvE6jE
Subject: [jose] JSON Web Key (JWK) Thumbprint Specification
X-BeenThere: jose@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Javascript Object Signing and Encryption <jose.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/jose>, <mailto:jose-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/jose/>
List-Post: <mailto:jose@ietf.org>
List-Help: <mailto:jose-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/jose>, <mailto:jose-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 11 Apr 2014 00:50:27 -0000

I created a new simple spec that defines a way to create a thumbprint of an arbitrary key, based upon its JWK representation.  The abstract of the spec is:

This specification defines a means of computing a thumbprint value (a.k.a. digest) of JSON Web Key (JWK) objects analogous to the x5t (X.509 Certificate SHA-1 Thumbprint) value defined for X.509 certificate objects. This specification also registers the new JSON Web Signature (JWS) and JSON Web Encryption (JWE) Header Parameters and the new JSON Web Key (JWK) member name jkt (JWK SHA-256 Thumbprint) for holding these values.

The desire for this came up in an OpenID Connect context, but it's of general applicability, so I decided to submit the spec to the JOSE working group.  Thanks to James Manger, John Bradley, and Nat Sakimura for the discussions that led up to this spec.

The specification is available at:

*        http://tools.ietf.org/html/draft-jones-jose-jwk-thumbprint-00

An HTML formatted version is also available at:

*        https://self-issued.info/docs/draft-jones-jose-jwk-thumbprint-00.html

                                                            -- Mike

P.S.  I also posted this notice at http://self-issued.info/?p=1213 and as @selfissued.

v2.46.0 | Report a Bug | By Email | System Status