[jose] Re: Do you need the JWP JSON Serialization?

[Neil Madden <[e-mail]>]

On 8 Aug 2024, at 20:44, Orie Steele <[e-mail]> wrote:



That only applies to "SD-JWT+KB"

I don’t think so, otherwise SD-JWT would not be secure. The signature covers the claims, which includes the hashes of all the disclosures. Thus the disclosures are all protected (cannot be altered/forged) and immutable. 

[..]

Unless I am mistaken, there is no ordering requirement for the SD-JWT without key binding, so the disclosures are mutable, until the holder makes them immutable by applying key binding:

They are an unordered set, so this “mutability” is irrelevant. 

[…]

OS

On Thu, Aug 8, 2024 at 2:20 PM Neil Madden <[e-mail]> wrote:

Maybe I’m missing something, but all of the disclosures are covered by the SD-JWT signature and so (a) are protected, and are (b) immutable.

— Neil

On 8 Aug 2024, at 19:18, Orie Steele <[e-mail]> wrote:

That's fair : )

Let's replace "suspicion" with "I would have argued for a different design".

In JOSE, ~ is just used as a placeholder for "missing unprotected header".

You still need to validate that the correct mutable data was included, and that no "unexpected mutable data" was included.

That's a "verifier policy over mutable data".

In the context of SD-JWT that means checking disclosures, matching their hash to the kbt and making sure the kbt is signed by the cnf.

That is very similar to the kind of unprotected header processing that COSE supports, see:

https://www.rfc-editor.org/rfc/rfc9338.html#section-2" target="_blank" rel="nofollow">https://www.rfc-editor.org/rfc/rfc9338.html#section-2

Sure maybe it's less obvious that jwt (cnf) -> disclosures -> hash -> kbt signed by cnf is a kind of counter signature.

But it is a second signature, over a specific set of disclosures that is grouped together with the first signature, which are verified together.

https://datatracker.ietf.org/doc/html/draft-ietf-oauth-selective-disclosure-jwt-10#section-9.1" target="_blank" rel="nofollow">https://datatracker.ietf.org/doc/html/draft-ietf-oauth-selective-disclosure-jwt-10#section-9.1

"""
Unprotected headers other than disclosures are not covered by the digest, and therefore, as usual, are not protected against tampering.
"""

This is similar to how values in unprotected headers in COSE are not protected, unless there is some "verification process" such as checking a counter signature, or merkle tree inclusion proof.

Isn't JWP meant to replace SD-JWT in some cases that require stronger unlinkability?

IIRC SD-JWT and OAUTH had good reasons to define a JSON Serialization, and if it's used, those users should be able to switch to JWP or CWP in the future.

OS

On Thu, Aug 8, 2024 at 12:33 PM Brian Campbell <[e-mail]> wrote:

On Thu, Aug 8, 2024 at 11:27 AM Orie Steele <[e-mail]> wrote:

 <snip>

If JWTs had unprotected headers, I suspect SD-JWT would have used them for the mutable part (disclosures).

That suspicion is entirely incorrect. 

 

<snip>

CONFIDENTIALITY NOTICE: This email may contain confidential and privileged material for the sole use of the intended recipient(s). Any review, use, distribution or disclosure by others is strictly prohibited.  If you have received this communication in error, please notify the sender immediately by e-mail and delete the message and any file attachments from your computer. Thank you.

-- 

ORIE STEELE
Chief Technology Officer
http://www.transmute.industries/" target="_blank" rel="nofollow">www.transmute.industries

https://transmute.industries/" target="_blank" rel="nofollow">https://ci3.googleusercontent.com/mail-sig/AIorK4xqtkj5psM1dDeDes_mjSsF3ylbEa5EMEQmnz3602cucAIhjLaHod-eVJq0E28BwrivrNSBMBc">

_______________________________________________
jose mailing list -- [e-mail]
To unsubscribe send an email to [e-mail]

--

ORIE STEELE
Chief Technology Officer
www.transmute.industries

https://transmute.industries" target="_blank" rel="nofollow">https://ci3.googleusercontent.com/mail-sig/AIorK4xqtkj5psM1dDeDes_mjSsF3ylbEa5EMEQmnz3602cucAIhjLaHod-eVJq0E28BwrivrNSBMBc">