<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
h3
{mso-style-priority:9;
mso-style-link:"Heading 3 Char";
mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:13.5pt;
font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p.MsoPlainText, li.MsoPlainText, div.MsoPlainText
{mso-style-priority:99;
mso-style-link:"Plain Text Char";
margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
span.PlainTextChar
{mso-style-name:"Plain Text Char";
mso-style-priority:99;
mso-style-link:"Plain Text";
font-family:"Calibri",sans-serif;}
span.Heading3Char
{mso-style-name:"Heading 3 Char";
mso-style-priority:9;
mso-style-link:"Heading 3";
font-family:"Times New Roman",serif;
mso-fareast-language:DE;
font-weight:bold;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 70.85pt 2.0cm 70.85pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="DE" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoPlainText">Hi all,<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><span lang="EN-US">I created <a href="https://bitbucket.org/openid/mobile/issues/52/ciba-pairwise-identifiers-structuring-text">
https://bitbucket.org/openid/mobile/issues/52/ciba-pairwise-identifiers-structuring-text</a> to keep track of this.<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US">In pseudo code the calculation of sub could look like this:<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US" style="font-family:"Courier New"">// Client is authenticated at this point<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US" style="font-family:"Courier New"">If (client.sector_identifier) then
<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US" style="font-family:"Courier New""> // if we have a registered client identifier then use it<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US" style="font-family:"Courier New""> sub = SHA-256 ( client.sector_identifier || local_account_id || salt );<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US" style="font-family:"Courier New"">else
<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US" style="font-family:"Courier New""> //need to determine sector_identifier to use as non is registered for this Client<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US" style="font-family:"Courier New""> If (request_object && client.jwks_uri) then<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US" style="font-family:"Courier New""> // request object signature is valid and key from client.jwks_uri was used to sign it<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US" style="font-family:"Courier New""> sub = SHA-256 ( client.jwks_uri || local_account_id || salt );<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US" style="font-family:"Courier New""> else
<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US" style="font-family:"Courier New""> // no registered sector_identifier, no request_object<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US" style="font-family:"Courier New""> if (client.notification_uri) then<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US" style="font-family:"Courier New""> // not polling but notification mode<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US" style="font-family:"Courier New""> sub = SHA-256 ( client.notification_uri || local_account_id || salt );<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US" style="font-family:"Courier New""> else<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US" style="font-family:"Courier New""> // polling mode but not sector_identifier registered
<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US" style="font-family:"Courier New""> response.setError(“invalid_request”);<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US" style="font-family:"Courier New""> logError(“invalid_request”, “no sector identifier for %s”, client.id);<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US" style="font-family:"Courier New""> return;<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US" style="font-family:"Courier New""> endif<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US" style="font-family:"Courier New""> endif<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US" style="font-family:"Courier New"">endif<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US" style="font-family:"Courier New"">// have sub that is a pairwise identifier here</span><span lang="EN-US"><o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoPlainText"><b><span lang="EN-US">Having said all that I currently tend to change the spec to say:<o:p></o:p></span></b></p>
<p class="MsoPlainText"><b><span lang="EN-US">“In CIBA the Client MUST specify the sector_identifier_uri at registration time if the OP uses Pairwise Identifiers which is strongly recommended”.<o:p></o:p></span></b></p>
<p class="MsoPlainText"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US">Should we make sector_identifier_uri mandatory for CIBA and cull all other Pairwise Identifier text?<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US">Cheers<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US">Axel<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><b><span lang="EN-US" style="font-size:13.5pt;font-family:"Times New Roman",serif;mso-fareast-language:DE">Pairwise Identifier Algorithm<o:p></o:p></span></b></p>
<p class="MsoPlainText"><span lang="EN-US"><a href="https://openid.net/specs/openid-connect-core-1_0.html#PairwiseAlg">https://openid.net/specs/openid-connect-core-1_0.html#PairwiseAlg</a><o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US"><o:p> </o:p></span></p>
<h3><span lang="EN-US">"sector_identifier_uri" Validation<o:p></o:p></span></h3>
<p class="MsoPlainText"><span lang="EN-US"><a href="https://openid.net/specs/openid-connect-registration-1_0.html#SectorIdentifierValidation">https://openid.net/specs/openid-connect-registration-1_0.html#SectorIdentifierValidation</a>
<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US" style="mso-fareast-language:DE">-----Original Message-----<br>
From: Openid-specs-mobile-profile [mailto:openid-specs-mobile-profile-bounces@lists.openid.net] On Behalf Of Axel Nennker<br>
Sent: Dienstag, 23. Mai 2017 15:33<br>
To: openid-specs-mobile-profile@lists.openid.net<br>
Subject: [Openid-specs-mobile-profile] Issue #52: CIBA Pairwise Identifiers Structuring Text (openid/mobile)</span></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><span lang="EN-US">New issue 52: CIBA Pairwise Identifiers Structuring Text
</span><a href="https://bitbucket.org/openid/mobile/issues/52/ciba-pairwise-identifiers-structuring-text"><span lang="EN-US" style="color:windowtext;text-decoration:none">https://bitbucket.org/openid/mobile/issues/52/ciba-pairwise-identifiers-structuring-text</span></a><span lang="EN-US"><o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoPlainText">Axel Nennker:<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Should the text regarding Pairwise Identifiers be in its own section or should it stay in the sections on polling and notification?<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><span lang="EN-US">Polling: </span><a href="https://xml2rfc.tools.ietf.org/cgi-bin/xml2rfc.cgi?Submit=Submit&format=ascii&mode=html&type=ascii&url=https://bitbucket.org/openid/mobile/raw/tip/draft-mobile-client-initiated-backchannel-authentication.xml?at=default#rfc.section.3.5.1.1"><span lang="EN-US" style="color:windowtext;text-decoration:none">https://xml2rfc.tools.ietf.org/cgi-bin/xml2rfc.cgi?Submit=Submit&format=ascii&mode=html&type=ascii&url=https://bitbucket.org/openid/mobile/raw/tip/draft-mobile-client-initiated-backchannel-authentication.xml?at=default#rfc.section.3.5.1.1</span></a><span lang="EN-US"><o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US">Notification: </span><a href="https://xml2rfc.tools.ietf.org/cgi-bin/xml2rfc.cgi?Submit=Submit&format=ascii&mode=html&type=ascii&url=https://bitbucket.org/openid/mobile/raw/tip/draft-mobile-client-initiated-backchannel-authentication.xml?at=default#rfc.section.3.5.3.3"><span lang="EN-US" style="color:windowtext;text-decoration:none">https://xml2rfc.tools.ietf.org/cgi-bin/xml2rfc.cgi?Submit=Submit&format=ascii&mode=html&type=ascii&url=https://bitbucket.org/openid/mobile/raw/tip/draft-mobile-client-initiated-backchannel-authentication.xml?at=default#rfc.section.3.5.3.3</span></a><span lang="EN-US"><o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoPlainText">References to other specs:<o:p></o:p></p>
<p class="MsoPlainText"><span lang="EN-US">Core: </span><a href="https://openid.net/specs/openid-connect-core-1_0.html#PairwiseAlg"><span lang="EN-US" style="color:windowtext;text-decoration:none">https://openid.net/specs/openid-connect-core-1_0.html#PairwiseAlg</span></a><span lang="EN-US"><o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US">Validation of sector_identifier: </span>
<a href="https://openid.net/specs/openid-connect-registration-1_0.html#SectorIdentifierValidation"><span lang="EN-US" style="color:windowtext;text-decoration:none">https://openid.net/specs/openid-connect-registration-1_0.html#SectorIdentifierValidation</span></a><span lang="EN-US"><o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoPlainText">Axel<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Responsible: ignisvulpis<o:p></o:p></p>
<p class="MsoPlainText">_______________________________________________<o:p></o:p></p>
<p class="MsoPlainText"><span lang="EN-US">Openid-specs-mobile-profile mailing list
</span><a href="mailto:Openid-specs-mobile-profile@lists.openid.net"><span lang="EN-US" style="color:windowtext;text-decoration:none">Openid-specs-mobile-profile@lists.openid.net</span></a><span lang="EN-US"><o:p></o:p></span></p>
<p class="MsoPlainText"><a href="http://lists.openid.net/mailman/listinfo/openid-specs-mobile-profile"><span lang="EN-US" style="color:windowtext;text-decoration:none">http://lists.openid.net/mailman/listinfo/openid-specs-mobile-profile</span></a><span lang="EN-US"><o:p></o:p></span></p>
</div>
</body>
</html>