Re: [jose] #17: add 'aud' and 'iss' to 4.1 Reserved Header Parameter Names

[Dick Hardt <[e-mail]>]

On Apr 4, 2013, at 9:32 AM, Mike Jones <[e-mail]> wrote:

> Responding to your "unsettled" remark, I suspect most people are fine with having the "aud" and "iss" be claims in the JWT where they normally are.  Yes, you have to decrypt the token to get these claim values, but if you're going to use the token, you'll have to do that anyway.
> 
> I don't think it's clear to most people what problem is being solved by potentially these fields to be present in a different location.  Without a compelling use case, this just seems like more to implement without a clear benefit of doing so.


I will see if I can explain the use case better.

Why "iss" is needed:


Bob and Charlie each gave Alice a KID and a symmetric key to use to verify and decrypt tokens from them. 

The App and Alice share keys so Alice knows it is the App.

The User authorizes Bob to give the App a token (which authorizes the App to do something)

The App gives the token to Alice.

Since Alice indirectly received the token,  the only way for Alice to know who sent the token, is to look at the KID as the "iss" claim is encrypted. If the "kid" values are GUIDs, then Alice can just look up the "kid" and retrieve the associated symmetric key, and then decrypt and verify the token and THEN see who sent it. If there is a collision in KID values (Bon and Charlie gave the same KID for different keys), then Alice will not know which symmetric key to use.

Why "aud" is needed:

Dave gives a KID and symmetric key to Ellen, and Frank gives a KID and symmetric key to Gwen. 

Ellen and Gwen trust each other and know how to talk to each other. Gwen does not know Dave. Ellen does not know Frank

The App and Gwen share keys so Gwen knows it is the App.

The User authorizes Dave to give the App a token

Dave gives the token to Gwen (Dave does not have a relationship with Ellen)

Gwen now has a token that Ellen can decrypt and verify, but has no method for knowing that Ellen can do that. The "aud" property would allow Gwen to give the token to Ellen to decrypt and verify.

Feel free to ask for clarifications.

This is what is happening in A2P3 that enables a distributed system.

-- Dick