[OAUTH-WG] Disable JWK "use" parameter for octet sequence keys?
Vladimir Dzhuvinov <vladimir@connect2id.com> Sun, 19 April 2015 10:01 UTC
Return-Path: <vladimir@connect2id.com>
X-Original-To: oauth@ietfa.amsl.com
Delivered-To: oauth@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 776381A0373 for <oauth@ietfa.amsl.com>; Sun, 19 Apr 2015 03:01:22 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -0.5
X-Spam-Level:
X-Spam-Status: No, score=-0.5 tagged_above=-999 required=5 tests=[BAYES_05=-0.5, RCVD_IN_DNSWL_NONE=-0.0001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 87HMyTJywq9R for <oauth@ietfa.amsl.com>; Sun, 19 Apr 2015 03:01:21 -0700 (PDT)
Received: from p3plsmtpa12-10.prod.phx3.secureserver.net (p3plsmtpa12-10.prod.phx3.secureserver.net [68.178.252.239]) (using TLSv1.2 with cipher DHE-RSA-AES128-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EF9D11A0370 for <oauth@ietf.org>; Sun, 19 Apr 2015 03:01:20 -0700 (PDT)
Received: from [192.168.0.106] ([77.77.164.50]) by p3plsmtpa12-10.prod.phx3.secureserver.net with id Hm1K1q00A15ZTut01m1KHV; Sun, 19 Apr 2015 03:01:20 -0700
Message-ID: <55337CEE.2090605@connect2id.com>
Date: Sun, 19 Apr 2015 13:01:18 +0300
From: Vladimir Dzhuvinov <vladimir@connect2id.com>
Organization: Connect2id Ltd.
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Thunderbird/31.6.0
MIME-Version: 1.0
To: "oauth@ietf.org" <oauth@ietf.org>
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
Archived-At: <http://mailarchive.ietf.org/arch/msg/oauth/k21ks7nJ-KyQTP1t_rtFOrN6on0>
Subject: [OAUTH-WG] Disable JWK "use" parameter for octet sequence keys?
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/oauth/>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sun, 19 Apr 2015 10:01:22 -0000
A developer working with the Nimbus jose+jwt library raised the question whether setting of the public "use" [1] parameter should be disabled for JWKs of type "oct". This appears to make sense, even though the JWA spec [2] doesn't mention it. Is this correct? Thanks, Vladimir [1] http://tools.ietf.org/html/draft-ietf-jose-json-web-key-40#section-4.2 [2] http://tools.ietf.org/html/draft-ietf-jose-json-web-algorithms-40#section-6.4
- [OAUTH-WG] Disable JWK "use" parameter for octet … Vladimir Dzhuvinov
- Re: [OAUTH-WG] Disable JWK "use" parameter for oc… Brian Campbell
- Re: [OAUTH-WG] Disable JWK "use" parameter for oc… Vladimir Dzhuvinov