Re: [Privacy-pass] Issuer directory representation (#369)

I do not see a benefit to adopting JWKs at this stage. As you say, they are
somewhat complex for the PP use case.

Eli

On Thu, Jun 8, 2023 at 5:30 PM Christopher Wood <caw@heapingbits.net> wrote:

> Colin filed #369 [1] to discuss the current representation we are
> currently using for issuer directories. Basically, Privacy Pass chose to
> introduce a new representation that bears resemblance to that which is used
> in Private State Tokens [2] and is already specified in JSON Web Key Sets
> [3]. We should sort out what to do with this discrepancy.
>
> Speaking for myself, neither a JWK or JWT expert, I think we should stick
> with what's currently in the draft because (1) all formats seem mostly
> isomorphic and (2) JWKS are, to my knowledge, meant primarily for JWTs.
> Moreover, the way that keys are represented seems unnecessarily complex.
> Why do we need to specify any of the "kty", "alg", or "kid" parameters when
> they can be inferred from the token type and public key?
>
> Note that this is primarily relevant for origins that consume the
> directory and use it for the purposes of challenging clients, but it may in
> the future become relevant for clients that want to consume this resource
> for consistency checking purposes.
>
> What do others think?
>
> Best,
> Chris
>
> [1] https://github.com/ietf-wg-privacypass/base-drafts/issues/369
> [2] https://github.com/WICG/trust-token-api/blob/main/ISSUER_PROTOCOL.md
> [3] https://datatracker.ietf.org/doc/html/rfc7517
>
> --
> Privacy-pass mailing list
> Privacy-pass@ietf.org
> https://www.ietf.org/mailman/listinfo/privacy-pass
>