[OAUTH-WG] SWD, JWT, JWS, JWE, JWK, and OAuth JWT Profile specs updated

Mike Jones <Michael.Jones@microsoft.com> Wed, 14 December 2011 15:26 UTC

Received-SPF: pass (mail147-tx2: domain of microsoft.com designates 131.107.125.8 as permitted sender) client-ip=131.107.125.8; envelope-from=Michael.Jones@microsoft.com; helo=TK5EX14MLTC101.redmond.corp.microsoft.com ; icrosoft.com ;
From: Mike Jones <Michael.Jones@microsoft.com>
To: "oauth@ietf.org" <oauth@ietf.org>
Thread-Topic: SWD, JWT, JWS, JWE, JWK, and OAuth JWT Profile specs updated
Thread-Index: Acy6dK45izXMgjgrRpWpMzeRb+EDoA==
Date: Wed, 14 Dec 2011 15:26:00 +0000
Message-ID: <4E1F6AAD24975D4BA5B16804296739435F7625B7@TK5EX14MBXC283.redmond.corp.microsoft.com>
Accept-Language: en-US
Content-Language: en-US
Content-Type: multipart/alternative; boundary="_000_4E1F6AAD24975D4BA5B16804296739435F7625B7TK5EX14MBXC283r_"
MIME-Version: 1.0
Subject: [OAUTH-WG] SWD, JWT, JWS, JWE, JWK, and OAuth JWT Profile specs updated
Precedence: list

New versions of the SWD, JWT, JWS, JWE, JWK, and OAuth JWT Profile specs have been posted.  They address a number of comments received on the JOSE list and at the JOSE WG meeting in Taipei and make a number of clarifications, corrections, and editorial improvements.

The only breaking change made was to use short names in the JWK spec, as suggested during the WG meeting in Taipei, since JWK Key Object values are used as JWE Ephemeral Public Keys, and so compactness matters.  This also required corresponding changes in the JWE spec.

This checkin moves the definitions of the "prn" (principal) and "jti" (JSON Token ID) claims from other specs into the JWT spec, as both of these claims enable general token functionality that is likely to be used in many contexts.

This checkin is intended to be the last set of individual submissions of the JWS, JWE, and JWK drafts before they are refactored and submitted to the JOSE WG as working group drafts.  The primary changes requested by the JOSE WG but not yet done are to break the algorithm profiles and identifiers out into a new spec and to rework the terminology in the signature spec to use different terms for digital signature and HMAC integrity operations.

See the Document History sections of each document for a detailed description of the changes made.  These documents are available at:

*        http://tools.ietf.org/html/draft-jones-simple-web-discovery-02

*        http://tools.ietf.org/html/draft-jones-json-web-token-07

*        http://tools.ietf.org/html/draft-jones-json-web-signature-04

*        http://tools.ietf.org/html/draft-jones-json-web-encryption-02

*        http://tools.ietf.org/html/draft-jones-json-web-key-03

*        http://tools.ietf.org/html/draft-jones-oauth-jwt-bearer-03
HTML-formatted versions are available at:

*        http://self-issued.info/docs/draft-jones-simple-web-discovery-02.html

*        http://self-issued.info/docs/draft-jones-json-web-token-07.html

*        http://self-issued.info/docs/draft-jones-json-web-signature-04.html

*        http://self-issued.info/docs/draft-jones-json-web-encryption-02.html

*        http://self-issued.info/docs/draft-jones-json-web-key-03.html

*        http://self-issued.info/docs/draft-jones-oauth-jwt-bearer-03.html

Special thanks to Jim Schaad for his detailed comments on the JWS and JWE specs, many of which were incorporated into these drafts.

                                                            -- Mike

[OAUTH-WG] SWD, JWT, JWS, JWE, JWK, and OAuth JWT… Mike Jones