Re: [jose] A Unified Theory of JOSE Keys

[Anthony Nadalin <[e-mail]>]

Hi Richard,

As I read your note, you're proposing a special-purpose encryption format to use for keys.  I think it would be simpler to use the general-purpose encryption format we already have (JWE) to encrypt keys.  Indeed, draft-miller-jose-jwe-protected-jwk already clearly describes using JWE to encrypt JWKs and it's straightforward.  No invention required.

I also think that you're wrong in saying that we don't have the capability to encrypt private keys.  The Miller draft can be used to encrypt both symmetric and private keys.

I also think that you're wrong in saying that we don't have the capability to have attributes for keys.  The JWK format allows fields to be added for additional key attributes, as needed.

Let's keep things simple and use the general-purpose encryption format we already have, rather than inventing a special-purpose one.


From: [e-mail] [mailto:[e-mail]] On Behalf Of Richard Barnes
Sent: Friday, March 8, 2013 10:43 AM
To: [e-mail]
Subject: [jose] A Unified Theory of JOSE Keys

I've posted some draft slides for my presentation on JOSE keys:
<http://ipv.sx/ietf86/jose-keys.pdf>
Some thoughts are below to get the discussion started early...

What I'm proposing here is that we re-factor JWK and JWA to address all of the use cases we have for keys -- including public keys, wrapped/unwrapped private/symmetric keys, and key attributes.  That is, instead of doing wrapped symmetric keys in JWE, public keys in JWK, and the remainder somewhere else, we should just do all key management in JWK.

This actually entails less work than you might imagine.  JWE provides us with a wrapped symmetric key format, and Mike's recent draft provides an unwrapped, JSON-based symmetric key format.  From these we can extrapolate to wrapped private keys in a pretty straightforward fashion, and pick up the ability to add attributes to keys as a bonus.  The slide deck illustrates a proposed wrapping algorithm that would do this.

At the end of the slide deck, there's a proposal to edit JWK and JWA to add key wrapping.  To make that a little more precise, I would imagine the contents of the revised JWK draft to look something like the following (omitting identical sections):
-----BEGIN-----
4.  JSON Web Key (JWK) Format
4.1.  "kty" (Key Type) Parameter
4.2.  "use" (Key Use) Parameter
4.3.  "alg" (Algorithm) Parameter
4.4.  "kid" (Key ID) Parameter
4.5.  "kat" (Wrapped Key Attributes) Parameter
4.6.  "wk" (Wrapped Key) Parameter
4.7.  "epk" (Ephemeral Public Key) Header Parameter
4.8.  "jku" (JWK Set URL) Header Parameter
4.9.  "jwk" (JSON Web Key) Header Parameter
4.10. "x5u" (X.509 URL) Header Parameter
4.11. "x5t" (X.509 Certificate Thumbprint) Header Parameter
4.12. "x5c" (X.509 Certificate Chain) Header Parameter
4.13. "apu" (Agreement PartyUInfo) Header Parameter
4.14. "apv" (Agreement PartyVInfo) Header Parameter
5. Wrapped keys
5.1. Key Wrapping Procedure
5.2. Key Unwrapping Procedure
-----END-----
The revised JWA draft would just fold in the fields from draft-jones-jose-json-private-and-symmetric-key, and add the obvious encoding rules for RSA and EC keys.

Comments welcome!

Thanks,
--Richard