Re: [OAUTH-WG] JWK Thumbprint URI Specification

[David Chadwick]

On 24/11/2021 20:07, Mike Jones wrote:

The JSON Web Key (JWK) Thumbprint specification [RFC 7638] defines a method for computing a hash value over a JSON Web Key (JWK) [RFC 7517] and encoding that hash in a URL-safe manner. Kristina Yasuda and I have just created the JWK Thumbprint URI specification, which defines how to represent JWK Thumbprints as URIs. This enables JWK Thumbprints to be communicated in contexts requiring URIs, including in specific JSON Web Token (JWT) [RFC 7519] claims.

 

My immediate observation is why are you sending the thumbprint of the JSON Web Key and not sending the actual key value in the URI?

Sending the thumbprint means the recipient still has to have some other way of obtaining the actual public key, whereas sending the public key as a URI means that no other way is needed.

Kind regards

David

Use cases for this specification were developed in the OpenID Connect Working Group of the OpenID Foundation. Specifically, its use is planned in future versions of the Self-Issued OpenID Provider v2 specification.

 

The specification is available at:

·    https://www.ietf.org/archive/id/draft-jones-oauth-jwk-thumbprint-uri-00.html

 

                                                       -- Mike

 

P.S.  This note was also published at https://self-issued.info/?p=2211 and as @selfissued.

 

_______________________________________________
OAuth mailing list
OAuth@ietf.org
https://www.ietf.org/mailman/listinfo/oauth

_______________________________________________
OAuth mailing list
OAuth@ietf.org
https://www.ietf.org/mailman/listinfo/oauth