Re: [jose] #16: URI identifying a specific key in a JWK set

> I'd always just assumed that, short of some other means of figuring it out, a kid header would accompany a jku to identify the specific key in the set.

Indeed, “jku” needs to be accompanied by “kid” to work in general — but this is a crappy solution. 99% of the time that a “jku” is used you want to identify a single specific key so “jku” should be capable of doing that without requiring an extra field.

A JOSE header does have room for “kid” as well as “jku”. However, many contexts that use URIs as identifiers expect a URI to be THE identifier. Needing two fields to do one task is inevitably awkward.

Finally, identifying 1 item from a set is a perfect match for the whole purpose of URI fragments so merely by the principle of least astonishment JWK should specify how the fragment picks 1 key.

--
James Manger

From: jose-bounces@ietf.org [mailto:jose-bounces@ietf.org] On Behalf Of Brian Campbell
Sent: Monday, 25 March 2013 11:31 PM
To: jose issue tracker
Cc: draft-ietf-jose-json-web-key@tools.ietf.org; jose@ietf.org; james@manger.com.au
Subject: Re: [jose] #16: URI identifying a specific key in a JWK set

I'd always just assumed that, short of some other means of figuring it out, a kid header would accompany a jku to identify the specific key in the set.

On Sun, Mar 24, 2013 at 6:40 PM, jose issue tracker <trac+jose@trac.tools.ietf.org<mailto:trac+jose@trac.tools.ietf.org>> wrote:
#16: URI identifying a specific key in a JWK set

 When a public key is required to process a JOSE message, providing a URI
 for the key is a useful alternative to providing the actual key or a
 certificate. The URI needs to identify the specific individual public key
 required for the specific JOSE message. A URI that merely identifies a set
 of keys (one of which is the correct one) is not sufficient.

 Given that a "jku" field holds a URI pointing to a set of keys, we need to
 define how to use the fragment part of those URIs to identify a specific
 key in the set.

 Using the "kid" (key id) in the fragment would be a sensible choice.

--
-------------------------+-------------------------------------------------
 Reporter:               |      Owner:  draft-ietf-jose-json-web-
  james@manger.com.au<mailto:james@manger.com.au>    |  key@tools.ietf.org<mailto:key@tools.ietf.org>
     Type:  defect       |     Status:  new
 Priority:  major        |  Milestone:
Component:  json-web-    |    Version:
  key                    |   Keywords:
 Severity:  -            |
-------------------------+-------------------------------------------------

Ticket URL: <https://tools.ietf.org/wg/jose/trac/ticket/16>
jose <http://tools.ietf.org/jose/>

_______________________________________________
jose mailing list
jose@ietf.org<mailto:jose@ietf.org>
https://www.ietf.org/mailman/listinfo/jose