[jose] Use case for "jku" in JWS

Anders Rundgren <anders.rundgren.net@gmail.com> Mon, 08 May 2017 17:45 UTC

From: Anders Rundgren <anders.rundgren.net@gmail.com>
To: "jose@ietf.org" <jose@ietf.org>
References: <ea29facd-1c27-5ace-0137-282cf30f6230@gmail.com>
Message-ID: <915f610a-8543-fd33-9501-8cc4ba1cb50e@gmail.com>
Date: Mon, 08 May 2017 19:45:07 +0200
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.8.0
MIME-Version: 1.0
In-Reply-To: <ea29facd-1c27-5ace-0137-282cf30f6230@gmail.com>
Content-Type: text/plain; charset="utf-8"; format="flowed"
Content-Transfer-Encoding: 7bit
Archived-At: <https://mailarchive.ietf.org/arch/msg/jose/9qbIWTToFQbuwbAabvdNhangbnU>
Subject: [jose] Use case for "jku" in JWS
Precedence: list

https://tools.ietf.org/html/rfc7515#section-4.1.2

I had planned to implement support for URL-based keys in my JCS specification
to make it even more compatible with JOSE.  However, I haven't done that yet,
and now I'm beginning to actually questioning the value of this concept.

If somebody could provide a compelling real-world use case I would be more than happy!

In the meantime I have toyed with another scheme combining URLs and in-line (JWK)
public key descriptors, coined "Authority Objects".  The core features include:
- Signed objects can always be verified for [technical] correctness including off-line
- Arbitrary extensive issuer information and its associated keys are kept in a consolidated
    document (which in turn may have been signed by another "governing" party)
- Intrinsic revocation support

Actual example (if the server is up and running...): https://mobilepki.org/webpay-acquirer/
Concept specification: https://cyberphone.github.io/doc/defensive-publications/authority-objects.pdf

Comments?

Anders

[jose] Use case for "jku" in JWS Anders Rundgren