Re: [Secdispatch] draft-madden-jose-ecdh-1pu

[Neil Madden <[e-mail]>]

> On 17 May 2021, at 15:59, Michael Richardson <[e-mail]> wrote:
> 
> 
> Neil Madden <[e-mail]> wrote:
>>> Neil Madden <[e-mail]> wrote:
> 
>>>> The draft was originally created to support work within the OAuth WG
>>>> around JWT-format access tokens. However, the WG declined to adopt
>>>> the draft, so it’s looking for a new home. I believe the draft is
>>>> ideally
>>> 
>>> Did the WG give a reason?
>>> 
> 
>> The meeting was some time ago now, but as I remember it essentially
>> they felt that it was outside of their charter and area of
>> expertise. Although the OAuth WG have done work around JWTs
>> specifically in the past, they have not ever approved new cryptographic
>> algorithms.
> 
> So, "good idea", sounds like OAUTH would use it, but they feel it is the
> wrong place.

Yes, pretty much.

I’m actually wondering if re-chartering the JOSE working group may be a good way to proceed here? I have another (now expired) draft for a new algorithm [1] that I know at least one other vendor was keen to implement, and I believe there have been other potential ideas for JOSE improvements/changes. For example, I believe there is some interest in deprecating the “none” algorithm, which was the cause of some attacks. At some point in the not-too-distant future I would think that JOSE should really standardise at least one post-quantum encryption and signature algorithm too.

[1]: https://datatracker.ietf.org/doc/draft-madden-jose-siv-mode/ <https://datatracker.ietf.org/doc/draft-madden-jose-siv-mode/> 

— Neil
-- 
ForgeRock values your Privacy <https://www.forgerock.com/your-privacy>