Re: [OAUTH-WG] Last Call: <draft-ietf-oauth-jwk-thumbprint-uri-01.txt> (JWK Thumbprint URI) to Proposed Standard

David Waite <david@alkaline-solutions.com> Wed, 11 May 2022 16:36 UTC

Return-Path: <david@alkaline-solutions.com>
X-Original-To: oauth@ietfa.amsl.com
Delivered-To: oauth@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B4439C15949F; Wed, 11 May 2022 09:36:28 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -7.097
X-Spam-Level:
X-Spam-Status: No, score=-7.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, UNPARSEABLE_RELAY=0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=alkaline-solutions.com
Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JgSnfja7n8gl; Wed, 11 May 2022 09:36:24 -0700 (PDT)
Received: from caesium6.alkaline.solutions (caesium6.alkaline.solutions [157.230.133.164]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8B0CBC15E408; Wed, 11 May 2022 09:36:24 -0700 (PDT)
Received: from authenticated-user (PRIMARY_HOSTNAME [PUBLIC_IP]) by caesium6.alkaline.solutions (Postfix) with ESMTPA id 6D91E206E2C; Wed, 11 May 2022 16:36:21 +0000 (UTC)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=alkaline-solutions.com; s=dkim; t=1652286983; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=Pm/CYAT92qM7I8ciaTaXhOOWPCGPA47oButW5HQeRgk=; b=KWTIA5jRNVvccvgynupSlqYcAGVXZanvBVbZTpoHZyj1IRFW9UmrqFK89EyiIKTfd3DFF0 3pr3d4jLSIBrnImrbB8HGUGVvhvF6dkfy8nBxzRiQUP2EClPbPlJU2sQO4bzByFsi3r9a1 BhP77sbt4HKJYlOBQdRhgoF353ZTl8Q=
From: David Waite <david@alkaline-solutions.com>
Message-Id: <CDB03472-8DE3-4B4A-B23D-698E36E4551D@alkaline-solutions.com>
Content-Type: multipart/alternative; boundary="Apple-Mail=_14251FF6-9D60-4D86-BEB4-5CC28069AD45"
Mime-Version: 1.0
Date: Wed, 11 May 2022 10:36:20 -0600
In-Reply-To: <CADNypP93Ut4zpRvhjotTwBZ6+MgXasugB1nWbCfvcb-3k5bQRg@mail.gmail.com>
Cc: Mike Jones <Michael.Jones@microsoft.com>, "Manger, James" <James.H.Manger=40team.telstra.com@dmarc.ietf.org>, "last-call@ietf.org" <last-call@ietf.org>, "draft-ietf-oauth-jwk-thumbprint-uri@ietf.org" <draft-ietf-oauth-jwk-thumbprint-uri@ietf.org>, "oauth-chairs@ietf.org" <oauth-chairs@ietf.org>, "oauth@ietf.org" <oauth@ietf.org>
To: Rifaat Shekh-Yusef <rifaat.s.ietf@gmail.com>
References: <165092137918.1385.17213010140457783707@ietfa.amsl.com> <ME3PR01MB59734146D665E8834FE3FC40E5FB9@ME3PR01MB5973.ausprd01.prod.outlook.com> <SJ0PR00MB10056834E04389B9C5A918B2F5C09@SJ0PR00MB1005.namprd00.prod.outlook.com> <CADNypP8ZwqeXJGabGVhKamsQa9JQqD=10dB57++cDZFuQXUuDg@mail.gmail.com> <600A7327-CEDD-433B-B457-319CE36827E9@alkaline-solutions.com> <CADNypP93Ut4zpRvhjotTwBZ6+MgXasugB1nWbCfvcb-3k5bQRg@mail.gmail.com>
Authentication-Results: caesium6.alkaline.solutions; auth=pass smtp.mailfrom=david@alkaline-solutions.com
X-Spamd-Bar: +
Archived-At: <https://mailarchive.ietf.org/arch/msg/oauth/WsGFMrV-urj_5swlUZ8Yog9Cqvg>
Subject: Re: [OAUTH-WG] Last Call: <draft-ietf-oauth-jwk-thumbprint-uri-01.txt> (JWK Thumbprint URI) to Proposed Standard
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.34
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/oauth/>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 11 May 2022 16:36:28 -0000

On May 11, 2022, at 6:45 AM, Rifaat Shekh-Yusef <rifaat.s.ietf@gmail.com> wrote:
> On Wed, May 11, 2022 at 4:53 AM David Waite <david@alkaline-solutions.com <mailto:david@alkaline-solutions.com>> wrote:
> The information dropping of the canonicalization in JWK thumbprints results in a few important properties - in particular, a local JWK document representing a private key and the shared JWK document representing the corresponding public key will have the same thumbprint.
> 
> Can you elaborate on this? how would two different documents produce the same hash?

Sure. In terms of named information, we could refer to an instance of a JWK that has had the thumbprint canonicalization rules partially applied to it, such that it would refer to a valid JWK with the identical hash of the JWK thumbprint.

However, a named information is meant to refer to a specific resource with a specific series of bytes. This ni-scheme URI would refer only to the resource that is that specific canonicalized JWK, with certain information stripped. 

In the semantics of a JWK thumbprint however, the hash refers to an infinite set of documents that might have different JSON serialization order, whitespace, and/or additional optional JWK fields (including potentially the private key information.) The JWK thumbprint is meant to serve as a common identifying value by all parties to a particular logical key. JWK Thumbprint URI simply provide a common scheme for expressing that identifier as a URI.

So, the resolving a named information URI is defined to give you a particular binary entity representation, while resolving a thumbprint will give you one of possibly many object representations that share certain cryptographic properties. Thus I don’t feel it is appropriate to use the same URI scheme to represent both, even though they are potentially isomorphic data forms - we would be using ni-scheme URI as a hash value container rather than for the defined named information semantics.

-DW