Re: [jose] 'aud' and 'iss' in JWE header

Will that be compliant though? I would like to spec to say that I can optionally include those properties in the header of a JWE.

On Mar 25, 2013, at 4:02 PM, John Bradley <ve7jtb@ve7jtb.com> wrote:

> Once the change to ignore additional elements in the header there is nothing to stop you from doing that.
> 
> You make a good point about scoping the 'kid' to the 'iss'. 
> 
> John B.
> 
> On 2013-03-25, at 7:53 PM, Dick Hardt <dick.hardt@gmail.com> wrote:
> 
>> Hello everyone
>> 
>> As I am implementing JOSE JWE, I would like to know who the 'iss' and 'aud' is. I am using symmetric, shared keys and the 'aud' party would like to know they really are the intended 'aud' and who the 'isa' is. Otherwise the 'iss' is inferred from the 'kid', and there is no guarantee that two 'iss' won't have the same 'kid' for different keys from different 'iss'.
>> 
>> I don't see an issue with disclosure of who 'iss' and 'aud' are as any party able to intercept the token will have a pretty good idea of where it is coming from and where it is going to. Knowing the 'iss' and 'aud' allows the 'aud' to return an error before doing any crypto if the 'aud' does not match or if there is no 'kid' for the 'iss'.
>> 
>> Is there a reason why I cannot have 'iss' and 'aud' in the header?
>> 
>> This is not an issue with JWS since the payload is clear and the 'aud' can evaluate the 'iss' and 'aud' properties before doing crypto.
>> 
>> -- Dick
>> _______________________________________________
>> jose mailing list
>> jose@ietf.org
>> https://www.ietf.org/mailman/listinfo/jose
> 