Re: [jose] Rolling PKIX into JWK

[John Bradley <[e-mail]>]

Agreed,  having the cert chain in the x5u is optional,  having it for validation if you want that trust chain is not a problem.   Trying to optimize that for size is going to be too complicated.

John B.

On 2013-03-15, at 12:49 PM, Richard Barnes <[e-mail]> wrote:

> On Fri, Mar 15, 2013 at 2:43 AM, Manger, James H <[e-mail]> wrote:
> I agree, a certificate as an optional field of any JWK sounds like a decent approach.
> 
> +1, although it's not mutually exclusive with having a "PKIX" key type.
>  
> Putting a whole cert chain in one JWK is not ideal.
> Each cert is about 1 key so really should be in its own JWK.
> Otherwise you will duplicate the chain of intermediate CA certs in each JWK in a set.
> 
> It might be useful to define a issuer key-id field ("isskid"). A JWK could include a cert for its own key and (with "isskid") a link to the next cert along the chain. That makes it quick-n-easy to build a chain from the JWKs in a set.
> 
> It would also help if JWKs in a set where held in a object/dictionary/associative-array with the kid as the name. That would be better than using an array of JWKs with no defined meaning for the order.
> 
> This proposal seems much, much worse than having a cert chain in one JWK.  If you're going to have all the public keys as JWKs, you might as well just re-invent X.509 in JWK, in which case you would probably use JWS over JWK, which solves the "isskid" problem using the "kid" in the JWS.  The benefit of having the cert chain is that you don't have to re-invent X.509, you just pass the cert chain to your existing X.509 library.  
> 
> In other words, let's have the trust chain be fully X.509 or fully JOSE, even if it starts from a JWK.  
> 
> --Richard
> 
> 
>  
> 
> --
> James Manger
> 
> > -----Original Message-----
> > From: [e-mail] [mailto:[e-mail]] On Behalf Of
> > Matt Miller (mamille2)
> > Sent: Friday, 15 March 2013 12:48 AM
> > To: <[e-mail]>
> > Subject: [jose] Rolling PKIX into JWK
> >
> > [hoping this topic is the least controversial...]
> >
> > In some IRL discussions on moving forward on PKIX in JWK, I've been
> > convinced the concerns are mostly the same regardless of how the PKIX
> > is packaged.  Given that, I would suggest we make "x5c" an optional
> > field of JWK, rather than defining a new JWK type.  I can propose
> > various text additions after this meeting.
> >
> >
> > Thoughts?
> >
> > - m&m
> >
> > Matt Miller < [e-mail] >
> > Cisco Systems, Inc.
> 
> _______________________________________________
> jose mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/jose
> 
> _______________________________________________
> jose mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/jose