Re: [jose] #12: x5c incorrect in JWE

["Manger, James H" <[e-mail]>]

> #12: x5c incorrect in JWE
> 
> 
> Comment (by [e-mail]):
> 
>  For generality, I'll note that if people believe that "x5c" should be
> removed from JWE, then the same logic probably suggests that "x5u",
> "jku"
>  should be removed, as all are ways of including or referencing public
> key  values corresponding to the private key used to encrypt the
> content.  And  by that logic, if we don't need a way to reference or
> include public key  values for JWEs, then the "x5t" and possibly "kid"
> parameters would then  also be of dubious value.  At least by that
> reasoning, the inclusion of  all the key reference parameters would
> likely stand or fall together.

Yay! Drop the lot ("jku", "jwk", "x5u", "x5t", "x5c") from JWE; keep "kid".


Should we describe how to get a "kid" value from a certificate or a raw public key (in case an explicit "kid" value is not available to a JWE originator)? If you only have a cert you can look for a subjectKeyIdentifier extension -- though that is an OCTET STRING so it may need to be base64url-encoded (without padding) to give a "kid" string. A raw public key could be hashed to synthetise a "kid" value, but then you need a canonical form of the public key to hash.

--
James Manger