IETF Logo Mail Archive

Re: [OAUTH-WG] Signed JWK Sets

Michael Jones <michael_b_jones@hotmail.com> Sun, 17 March 2024 08:59 UTC

Return-Path: <michael_b_jones@hotmail.com>
X-Original-To: oauth@ietfa.amsl.com
Delivered-To: oauth@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5ADE9C151985 for <oauth@ietfa.amsl.com>; Sun, 17 Mar 2024 01:59:41 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.231
X-Spam-Level:
X-Spam-Status: No, score=-1.231 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FORGED_HOTMAIL_RCVD2=0.874, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_BLOCKED=0.001, RCVD_IN_MSPIKE_H2=-0.001, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001, URIBL_DBL_BLOCKED_OPENDNS=0.001, URIBL_ZEN_BLOCKED_OPENDNS=0.001] autolearn=no autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=hotmail.com
Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9BqP95gMiG85 for <oauth@ietfa.amsl.com>; Sun, 17 Mar 2024 01:59:37 -0700 (PDT)
Received: from NAM12-BN8-obe.outbound.protection.outlook.com (mail-bn8nam12olkn2052.outbound.protection.outlook.com [40.92.21.52]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 479FBC151082 for <oauth@ietf.org>; Sun, 17 Mar 2024 01:59:37 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=Oj2U9nrmJ97FaYHwWggdGAmKK6M7zuuM0CYTlgnkVQsNM2yGQJqJkyCrTnBwXzO8W8mT31xdOSt8Fq8Sz1G76THyDHX/5lDzAhwbds5zIY4oLK/G+uK0Re4fXEC/G7qK28EtaEBEyfXcq/T+p2RbvPY+fCcbGSqZr1Vjv/AUa/eNybeT7CMlgA5y5tW3csnDvITnlBFXFPcFYQEgM8fWbfrPBQH6Q9qFZoe789UmbMokf9d7OE0xsDDgHpXIq5q925zIOgASVdBXCNIlZ2BsaneL6jk05SBIJ5q9H73xjbJWNf+JroIe6684RwSKW7hzwFNvedRYFf4OVqnW4SlwTw==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=ai3glsiDl1/sTnZ6FPraSKvbfukDzfdkpp7fgkmSeF0=; b=GsBAdomm7W6Enlv1JlW8WMG5NjV1AyjQHMNtkzuoeox3bgtuKOWS9QdhbZjtZzNBu4b2vypBrI1mnbJS35oPBuDCbxI/GDki8Lbr6Vhb4xxFAZbyZu7z9VoQNxR7rGg7sfuQoPJOk6gj5N4i0UCDdf1/yy+yAGrduhDDWsXXGslt6ckZfme72vd+oLh+nJclOvGVpeGh8W/AnA6yE8YDDvVTkotf/xWQUPB/Dkn8ftPBq0pkiECPE+nLsLqRk9b8fTxqTU2EOJG4pGI22eGa5xrUTW7vQzdJkwi5VJHKy3bYGEjGL5YZaMg3JNr+LTStSimcHJdPO6ZoZKvOMuXmRw==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none; dkim=none; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=hotmail.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=ai3glsiDl1/sTnZ6FPraSKvbfukDzfdkpp7fgkmSeF0=; b=Cyc0adRtgH+6jYwDoL+Fztd4simfzQDXl40PezfqV+LOE43nM7zfPvVLp+C/7hKimkN8Z9gznfFs+s9Qe30QB/2ld+1D6/84TgZvZ7a0m+CoL3ZNF7SqZHkz62ZtsOdAjVD41ZAXKR85ebz3mzFOeJRGg0RCc1ETRjqnCImTL+j/7+M+kMZqEp94+KHyWAG8KQJV8b/tVEDWkvxSZe9wFnA2bYchv9gO95BlQ9FBx93a9jg5QDNrHBK2EmkrM3125Dh4+JezNHKtUVi0B+VZhgBnNBYbAiGD6gFSoW20dUvx6F41QuQoEFN2IwVtMhkFCSliIxYmpiuJgrOFaPupAw==
Received: from SJ0PR02MB7439.namprd02.prod.outlook.com (2603:10b6:a03:295::14) by DM6PR02MB6778.namprd02.prod.outlook.com (2603:10b6:5:212::7) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7386.21; Sun, 17 Mar 2024 08:59:34 +0000
Received: from SJ0PR02MB7439.namprd02.prod.outlook.com ([fe80::7c2c:4b2:7be3:4f66]) by SJ0PR02MB7439.namprd02.prod.outlook.com ([fe80::7c2c:4b2:7be3:4f66%4]) with mapi id 15.20.7386.023; Sun, 17 Mar 2024 08:59:34 +0000
From: Michael Jones <michael_b_jones@hotmail.com>
To: Richard Barnes <rlb@ipv.sx>, "oauth@ietf.org WG" <oauth@ietf.org>
CC: Sharon Goldberg <goldbe@bastionzero.com>
Thread-Topic: [OAUTH-WG] Signed JWK Sets
Thread-Index: AQHaeC/UUy5MTMaZJku8hmwFtwRvCbE7oQ7Q
Date: Sun, 17 Mar 2024 08:59:34 +0000
Message-ID: <SJ0PR02MB7439C916CB3F603C8E41ED53B72E2@SJ0PR02MB7439.namprd02.prod.outlook.com>
References: <CAL02cgSANrR=nys3RXDOYJPibLkv25X8Okq4dhL0Dpfi_ZSS_A@mail.gmail.com>
In-Reply-To: <CAL02cgSANrR=nys3RXDOYJPibLkv25X8Okq4dhL0Dpfi_ZSS_A@mail.gmail.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-tmn: [CjAOqujjO19k2qNsUr7FVLz2kvanoo9vGtcZlJee9cU=]
x-ms-publictraffictype: Email
x-ms-traffictypediagnostic: SJ0PR02MB7439:EE_|DM6PR02MB6778:EE_
x-ms-office365-filtering-correlation-id: 737289e7-0dbe-467a-b94a-08dc46609103
x-microsoft-antispam: BCL:0;
x-microsoft-antispam-message-info: 4NQM1dtmiDBp8wIAg9lECYYNi67Iz/ux/Imwyk8cFDvYpWWnRHGj+ESYczEWSZgN8Klby7mQ8ZqGDZ+UYZaAhnvlDs/Q76QSyDbHjP03M0uVBSuE/IgMUyQhLZFxTTVLaIygI6hpXHavfEhkxIpmdZelzlVZFRid8LbikmzJehjzrY1jkwQnLgVSqX1vIYRZb/zp0pUaBHOtEwe3BX2WAFU6Gj4uRKVtyh/+X4YdBgJ0vuu/dRZ3IjSvvHoQrZCG6t/6uMn/qu9av+S5vK3k/bX7jn20KN2eOsEgp3jZe7hcAeBItACUUoOgSQ6KBwbP2oCvSTVaUPuw08cez/EBcGNAB0OsrGqEBw7ZJkJ2D/gkkjHpDE1YTHJtAowD07YH5W0uF/dWCs0NBahRIhAqkgDJCoMJpeM2lB/IqE/1VvHw4WAepMQM88Y1WJ5PQnP8th9qerIeF4lyAMRIJIOMEEyj5MjHBVI9+QJKi1yF7lY4M7ZauBLFH5hJidUY6FvJrbB2cNovF1WdwrKKFVOZ1/5fehq0cC5eHTxAaCJREsBPAiGB7d2CNbrEYrpV1u8h0Z5ejaPufHLwe6u5e7ufTrm9OFHOc+aygiUyVa7R/nBzjrctFh57FHTneTt5U7qaXFG+la6HYjKbAVrs6vgslZm1sZYnOVpp6TmKGwDzOmVAg+DUcailBTshWnYdZ13T
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: 1IApEsKsBNYNq/YbSHwTC0fGcnS3ZUuFhGN8aH5iJpdQN5/J266URsq5YiMHLYLeqAHd1pZtcSpRbH1Gh60usVRjYi7aBBmWYreuH6WiboHxGTpqvC8sZOQUjlc3Kqr8aX6Ie6iNEMZcbpSPl16BjvAO4+WY5nt1d8wy1s0UB7Asns28MODOpePKU4j/aHVmWeGZI01ir/CfrDX71QwRUsdMCCF0MqvLXsMPauY+fHUWfnvMzwGnwTir76I66idTy4hLhdFLH1xkNs/ot82A59uj4eYG9gYGf8RZL1CtSsbodAIkBnkUTviLLodkWzzj1CBmhYilIS4Wl0Kp6XNydUsFRXiATYgPTHjY/NVIEbW2k7jHbTxwJADfiOrRXORgy6kuFs9Jn2TThqIUlVcbcNsvndf+kXgavPzCt8Eo/iLh+lnrE+tFmClazGbEId/mWLRSYqgZ3VwNBTmbU/coxkXstUS5jCTauVvg47Xb4eoWZxx/9t0c6F9P8oC6ldWHleHK11nT/z9Ciu2AjyhRwq1QySGhfWOY3n8IgjUe3qk7Xqd0LrfrQFvBOKI47cCPBgzoPaGm14+R6HxG1wjXlobbhwgv98ikYSkvJsis9qIGNWlNcNgT4rqbTuuFzdAO+hFS9kP9v99EUBNnQS9ntD74GbsP9brqhISjNY8p764LpVAOz7MInGoPK6af017xnpk4DFqi8z+9jfBtEkJmSl9KVa1SfYhqW98FnrkrZGbYXVmJknbCo6fnz5mlsMdFHlF03pMoRUZTtXiVZXU/iB/oucxwezMZ0ihPYXPE6CURAbp1teJTPz/Kfv0fwYuz6j8572XIFlZYZegDPWtcSeJ8vLNCmOQw3rxW6g+FJekKR9qBmSKScWQOyX2d1QmdFQYG6+sYre9Ds7UoGcFJ2ACVsrOCJs8G14vNMsfsw6VOrdAjBe0ykBScGgJl09mznO3WKoOKg0fbph/7ziA5+Q/7hjOZfkRj9XmUE8Q1yV6VbpzlD3/STa7tkL4u23mLQWVCHKUPxEs443iesAMpZ7hBnWgnF80PvJ1ZeLnCWSJqrlL5jkV0I1ykvObMESuTzKHlFMi9hH1h6V2wmEY06G11WSX4VKDCjnW6D0GuCV+QS4w0w4kUmqJuDUtYlpqBw4Zir1lURPJQeiqTV6eIbMkapukYnai9VxlyYzcmhBtey3eyo3ZwTK8u3dFJ9YNWSq0XaakMTsypYvQIrkBSTw7QUFeKYAZgT+8dVjYqy8tW4s1q2C1ZmvVjf44teGAQ
Content-Type: multipart/alternative; boundary="_000_SJ0PR02MB7439C916CB3F603C8E41ED53B72E2SJ0PR02MB7439namp_"
MIME-Version: 1.0
X-OriginatorOrg: sct-15-20-4755-11-msonline-outlook-99c3d.templateTenant
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: SJ0PR02MB7439.namprd02.prod.outlook.com
X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000
X-MS-Exchange-CrossTenant-Network-Message-Id: 737289e7-0dbe-467a-b94a-08dc46609103
X-MS-Exchange-CrossTenant-originalarrivaltime: 17 Mar 2024 08:59:34.3292 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa
X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM6PR02MB6778
Archived-At: <https://mailarchive.ietf.org/arch/msg/oauth/O4hOWph9lFuEVkgGfG_uNzeyfmg>
Subject: Re: [OAUTH-WG] Signed JWK Sets
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.39
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/oauth/>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sun, 17 Mar 2024 08:59:41 -0000

Signed JWK Sets are part of the OpenID Federation specification and are in production use.  For instance, see https://openid.net/specs/openid-federation-1_0.html#name-metadata-extensions-for-jwk and the "keys" registration at https://openid.net/specs/openid-federation-1_0.html#name-registry-contents-7.  I believe that should already do what you need.  If you believe it doesn't, I'd be curious to discuss why not with you here in Brisbane.

                                                                Best wishes,
                                                                -- Mike

From: OAuth <oauth-bounces@ietf.org> On Behalf Of Richard Barnes
Sent: Sunday, March 17, 2024 3:55 PM
To: oauth@ietf.org WG <oauth@ietf.org>
Cc: Sharon Goldberg <goldbe@bastionzero.com>
Subject: [OAUTH-WG] Signed JWK Sets

Hi all,

A few of us have been considering use cases for JWTs related to Verifiable Credentials and container signing, which require better "proof of authority" for JWT signing keys.  Sharon Goldberg and I wrote up a quick specification for how to sign a JWK set, and how you might extend discovery mechanisms to present such a signed JWK set:

https://github.com/bifurcation/redistributable-jwks/blob/main/draft-barnes-oauth-redistributable-jwks.md

(Just in GitHub for now; will publish as an I-D when the window reopens tomorrow.)

If we could get this functionality added to OAuth / OIDC, it would make these use cases work a lot better.  As a prelude toward proposing working group adoption, it would be great to know if this design seems helpful to other folks as well.  Obviously, happy to answer any questions / comments.

Thanks,
--Richard

v2.23.0 | Report a Bug | By Email