Re: [jose] #16: URI identifying a specific key in a JWK set

A related issue is that a 'kid' may not be enough to uniquely identify the key in symmetric systems.

If a recipient (A) accepts tokens from multiple parties (B and C), and 'kid' is managed at those parties (B and C), then there is no guarantee that the 'kid' value will be unique at A. Knowing the issuer is required unless you force B and C to use a URI like mechanism for 'kid'

On Mar 25, 2013, at 3:46 PM, "Manger, James H" <James.H.Manger@team.telstra.com> wrote:

> > I'd always just assumed that, short of some other means of figuring it out, a kid header would accompany a jku to identify the specific key in the set.
>  
> Indeed, “jku” needs to be accompanied by “kid” to work in general — but this is a crappy solution. 99% of the time that a “jku” is used you want to identify a single specific key so “jku” should be capable of doing that without requiring an extra field.
>  
> A JOSE header does have room for “kid” as well as “jku”. However, many contexts that use URIs as identifiers expect a URI to be THE identifier. Needing two fields to do one task is inevitably awkward.
>  
> Finally, identifying 1 item from a set is a perfect match for the whole purpose of URI fragments so merely by the principle of least astonishment JWK should specify how the fragment picks 1 key.
>  
> --
> James Manger
>  
> From: jose-bounces@ietf.org [mailto:jose-bounces@ietf.org] On Behalf Of Brian Campbell
> Sent: Monday, 25 March 2013 11:31 PM
> To: jose issue tracker
> Cc: draft-ietf-jose-json-web-key@tools.ietf.org; jose@ietf.org; james@manger.com.au
> Subject: Re: [jose] #16: URI identifying a specific key in a JWK set
>  
> I'd always just assumed that, short of some other means of figuring it out, a kid header would accompany a jku to identify the specific key in the set.
>  
> 
> On Sun, Mar 24, 2013 at 6:40 PM, jose issue tracker <trac+jose@trac.tools.ietf.org> wrote:
> #16: URI identifying a specific key in a JWK set
> 
>  When a public key is required to process a JOSE message, providing a URI
>  for the key is a useful alternative to providing the actual key or a
>  certificate. The URI needs to identify the specific individual public key
>  required for the specific JOSE message. A URI that merely identifies a set
>  of keys (one of which is the correct one) is not sufficient.
> 
>  Given that a "jku" field holds a URI pointing to a set of keys, we need to
>  define how to use the fragment part of those URIs to identify a specific
>  key in the set.
> 
>  Using the "kid" (key id) in the fragment would be a sensible choice.
> 
> --
> -------------------------+-------------------------------------------------
>  Reporter:               |      Owner:  draft-ietf-jose-json-web-
>   james@manger.com.au    |  key@tools.ietf.org
>      Type:  defect       |     Status:  new
>  Priority:  major        |  Milestone:
> Component:  json-web-    |    Version:
>   key                    |   Keywords:
>  Severity:  -            |
> -------------------------+-------------------------------------------------
> 
> Ticket URL: <https://tools.ietf.org/wg/jose/trac/ticket/16>
> jose <http://tools.ietf.org/jose/>
> 
> _______________________________________________
> jose mailing list
> jose@ietf.org
> https://www.ietf.org/mailman/listinfo/jose
>  
> _______________________________________________
> jose mailing list
> jose@ietf.org
> https://www.ietf.org/mailman/listinfo/jose