[Openid-specs-ab] MTI encryption algorithms not specified

Nat Sakimura n-sakimura at nri.co.jp
Wed Aug 6 02:28:20 UTC 2014

Perhaps we may want to strategize on what kind of package we should put these in. 


On Wed, 6 Aug 2014 00:55:57 +0000
Mike Jones <Michael.Jones at microsoft.com> wrote:

> During interop testing work, Roland pointed out that while we specify
> an MTI signing algorithm (RS256) we don't specify MTI encryption
> algorithms for implementations that support encryption.  We come
> close for "enc" by saying in Registration that the default is
> A128CBC-HS256.  But while the default for "alg" should be "RSA1_5",
> we never say that.
> This may not be an errata-class change, but I'd think that profiles
> that use encryption should definitely include this.  Something to
> keep in mind...
>                                                             -- Mike

More information about the Openid-specs-ab mailing list