[Openid-specs-ab] MTI encryption algorithms not specified
n-sakimura at nri.co.jp
Wed Aug 6 02:28:20 UTC 2014
Perhaps we may want to strategize on what kind of package we should put these in.
On Wed, 6 Aug 2014 00:55:57 +0000
Mike Jones <Michael.Jones at microsoft.com> wrote:
> During interop testing work, Roland pointed out that while we specify
> an MTI signing algorithm (RS256) we don't specify MTI encryption
> algorithms for implementations that support encryption. We come
> close for "enc" by saying in Registration that the default is
> A128CBC-HS256. But while the default for "alg" should be "RSA1_5",
> we never say that.
> This may not be an errata-class change, but I'd think that profiles
> that use encryption should definitely include this. Something to
> keep in mind...
> -- Mike
More information about the Openid-specs-ab