[OAUTH-WG] Fwd: New Version Notification for draft-ietf-oauth-jwt-bcp-06.txt

Yaron Sheffer <yaronf.ietf@gmail.com> Fri, 07 June 2019 18:17 UTC

References: <155993088012.27385.9526522170989488513.idtracker@ietfa.amsl.com>
To: oauth <oauth@ietf.org>
From: Yaron Sheffer <yaronf.ietf@gmail.com>
Message-ID: <dab0f52e-c43b-236d-3f5e-90013cf18dee@gmail.com>
Date: Fri, 07 Jun 2019 21:17:35 +0300
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.7.0
MIME-Version: 1.0
In-Reply-To: <155993088012.27385.9526522170989488513.idtracker@ietfa.amsl.com>
Content-Type: text/plain; charset="utf-8"; format="flowed"
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Archived-At: <https://mailarchive.ietf.org/arch/msg/oauth/Bs8l02Yi3iqDE3nN2rqh2HVTEgE>
Subject: [OAUTH-WG] Fwd: New Version Notification for draft-ietf-oauth-jwt-bcp-06.txt
Precedence: list

Dear WG members,

Version -06 addresses Roman's AD comments, basically separating the 
rationale from the recommendations to maintain the document's internal 
consistency.

We also removed one SHOULD-level recommendation, "Sensitive information, 
such as passwords, SHOULD be padded before being encrypted." While 
length hiding would be nice in principle, standard ciphers such as 
AES-GCM do not provide it out of the box.

Thanks,
	Yaron

-------- Forwarded Message --------
Subject: New Version Notification for draft-ietf-oauth-jwt-bcp-06.txt
Date: Fri, 07 Jun 2019 11:08:00 -0700
From: internet-drafts@ietf.org
To: Michael B. Jones <mbj@microsoft.com>, Dick Hardt 
<dick.hardt@gmail.com>, Yaron Sheffer <yaronf.ietf@gmail.com>, Michael 
Jones <mbj@microsoft.com>


A new version of I-D, draft-ietf-oauth-jwt-bcp-06.txt
has been successfully submitted by Yaron Sheffer and posted to the
IETF repository.

Name:		draft-ietf-oauth-jwt-bcp
Revision:	06
Title:		JSON Web Token Best Current Practices
Document date:	2019-06-07
Group:		oauth
Pages:		16
URL: 
https://www.ietf.org/internet-drafts/draft-ietf-oauth-jwt-bcp-06.txt
Status:         https://datatracker.ietf.org/doc/draft-ietf-oauth-jwt-bcp/
Htmlized:       https://tools.ietf.org/html/draft-ietf-oauth-jwt-bcp-06
Htmlized: 
https://datatracker.ietf.org/doc/html/draft-ietf-oauth-jwt-bcp
Diff: 
https://www.ietf.org/rfcdiff?url2=draft-ietf-oauth-jwt-bcp-06

Abstract:
    JSON Web Tokens, also known as JWTs, are URL-safe JSON-based security
    tokens that contain a set of claims that can be signed and/or
    encrypted.  JWTs are being widely used and deployed as a simple
    security token format in numerous protocols and applications, both in
    the area of digital identity, and in other application areas.  The
    goal of this Best Current Practices document is to provide actionable
    guidance leading to secure implementation and deployment of JWTs.

 


Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

The IETF Secretariat

[OAUTH-WG] Fwd: New Version Notification for draf… Yaron Sheffer
Re: [OAUTH-WG] Fwd: New Version Notification for … Roman Danyliw