Re: [jose] #17: add 'aud' and 'iss' to 4.1 Reserved Header Parameter Names

[Dick Hardt <[e-mail]>]

On Apr 4, 2013, at 11:52 AM, John Bradley <[e-mail]> wrote:

> I am not against having them as JWE header elements, I have raised the point in several discussions.
> 
> However given that the decryption key is generally already in the hands of the RP it is hard to make the argument that a kid, thumbprint or jwk object are not enough for the recipient to identify what decryption key to use.

See my example

> 
> I can see a use in a case like Matt Millers XMPP encryption example where the sender doesn't know the public key of the recipient only its name in that case the recipient won't have the decryption key and needs to know in the unencrypted part of the message who to go and ask for the key.
> 
> I think in the XMPP case the recipient sends its public key and the received "kid" back to the issuer and asks for the decryption key to be encrypted by its public key and sent back.   This is perhaps the sort of thing where having the iss in the unencrypted envelope is a requirement.
> 
> "aud" is also arguably useful if you have a multi hop situation where the client needs to make a forwarding decision without creating yet another level of wrapping for the token.

I have potential multi hop that requires "aud"

> 
> So I do see uses for them.  
> 
> I do agree with Mike that it may be best to use the definitions in JWT and have the processing rule about what happens if you get the claim in the header and in the body or if it is only in the header laid out there.   
> 
> The thing that is important in a JWE context is if those claims are going to be integrity protected.   There is continued debate about removing the envelope from the integrity protection.  That is a JWE issue.   I also think if they are in JWT as being allowed in the JWE header referencing that from JWE is not a bad thing. 

I would think it would make sense to have one list of reserved JWE header parameters, not two. Of course, additional ones may be defined in an IANA registry.