<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">If you use a key with keyid of 1 you should make that key available in both formats. Given that x.509 certificates don't have keyID you probably need to include both a thumbprint and and a keyID if you are making keys available in both formats.<div><br></div><div>I could add the public key for a given ID/thumbprint combination should be identical in both formats.</div><div><br></div><div>I am also open to the argument that they don't need to be identical, as long as the receiver can process it. </div><div>The bottom line is that the receiver and sender need to publish keys that they can identify when they receive things signed or encrypted.</div><div><br></div><div>For JWK the kid is the obvious way to identify keys, with x.509 that is less obvious. Should we be more prescriptive and specify thumbprint or something else?</div><div><br></div><div>John B.</div><div> <br><div><div>On 2012-06-27, at 2:42 PM, Dingwell, Robert A. wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite">
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif; ">
<div>I get that from a JWK point of view, but what is suppose to live at the end of the jwk_url <span style="font-style: italic; "> and jwk_</span>encryption_url parameters of an idP or a client as far as section 4.2 in the Messages spec goes? It doesn't make
a distinction as to if it expects those urls to point to keys or key sets. At the end of section 4.2 is states that if keys are supplied in both X509 and JWK format then the keys must be identical. They can't be identical if one is a set and the other is
an X509 cert with just one key in it so it seems to implicitly state that the jwk_url and jwk_encruyption_url params point to single JWK's and not a Ket Set. </div>
<div><br>
</div>
<div><br>
</div>
<div>Rob</div>
<div><br>
</div>
<div><br>
</div>
<span id="OLK_SRC_BODY_SECTION">
<div style="font-family:Calibri; font-size:11pt; text-align:left; color:black; BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0in; PADDING-LEFT: 0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; PADDING-TOP: 3pt">
<span style="font-weight:bold">From: </span>Mike Jones <<a href="mailto:Michael.Jones@microsoft.com">Michael.Jones@microsoft.com</a>><br>
<span style="font-weight:bold">Date: </span>Wednesday, June 27, 2012 1:56 PM<br>
<span style="font-weight:bold">To: </span>Rob Dingwell <<a href="mailto:bobd@mitre.org">bobd@mitre.org</a>>, "<a href="mailto:openid-specs-ab@lists.openid.net">openid-specs-ab@lists.openid.net</a>" <<a href="mailto:openid-specs-ab@lists.openid.net">openid-specs-ab@lists.openid.net</a>><br>
<span style="font-weight:bold">Subject: </span>RE: JWK clarification<br>
</div>
<div><br>
</div>
<div xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:24.0pt;
mso-margin-bottom-alt:auto;
margin-left:24.0pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0in;
margin-bottom:.0001pt;
background:#CCCCCC;
font-size:12.0pt;
font-family:"Courier New";
color:black;}
span.EmailStyle17
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:"Courier New";
color:black;
background:#CCCCCC;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
<div lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1"><div class="MsoNormal"><span style="font-size: 11pt; color: rgb(31, 73, 125); font-family: Calibri, sans-serif; ">The top-level format continues to be an array of keys. Individual keys can also be used where appropriate. In the following example, an array of
keys is specified:<o:p></o:p></span></div><div class="MsoNormal"><span style="font-size: 11pt; color: rgb(31, 73, 125); font-family: Calibri, sans-serif; "><o:p> </o:p></span></div><p class="MsoNormal" style="background:#CCCCCC"><span lang="EN" style="color: black; font-family: 'Courier New'; ">{"keys":<o:p></o:p></span></p><p class="MsoNormal" style="background:#CCCCCC"><span lang="EN" style="color: black; font-family: 'Courier New'; "> [<o:p></o:p></span></p><p class="MsoNormal" style="background:#CCCCCC"><span lang="EN" style="color: black; font-family: 'Courier New'; "> {"alg":"EC",<o:p></o:p></span></p><p class="MsoNormal" style="background:#CCCCCC"><span lang="EN" style="color: black; font-family: 'Courier New'; "> "crv":"P-256",<o:p></o:p></span></p><p class="MsoNormal" style="background:#CCCCCC"><span lang="EN" style="color: black; font-family: 'Courier New'; "> "x":"MKBCTNIcKUSDii11ySs3526iDZ8AiTo7Tu6KPAqv7D4",<o:p></o:p></span></p><p class="MsoNormal" style="background:#CCCCCC"><span lang="EN" style="color: black; font-family: 'Courier New'; "> "y":"4Etl6SRW2YiLUrN5vfvVHuhp7x8PxltmWWlbbM4IFyM",<o:p></o:p></span></p><p class="MsoNormal" style="background:#CCCCCC"><span lang="EN" style="color: black; font-family: 'Courier New'; "> "use":"enc",<o:p></o:p></span></p><p class="MsoNormal" style="background:#CCCCCC"><span lang="EN" style="color: black; font-family: 'Courier New'; "> "kid":"1"},<o:p></o:p></span></p><p class="MsoNormal" style="background:#CCCCCC"><span lang="EN" style="color: black; font-family: 'Courier New'; "><o:p> </o:p></span></p><p class="MsoNormal" style="background:#CCCCCC"><span lang="EN" style="color: black; font-family: 'Courier New'; "> {"alg":"RSA",<o:p></o:p></span></p><p class="MsoNormal" style="background:#CCCCCC"><span lang="EN" style="color: black; font-family: 'Courier New'; "> "mod": "0vx7agoebGcQSuuPiLJXZptN9nndrQmbXEps2aiAFbWhM78LhWx<o:p></o:p></span></p><p class="MsoNormal" style="background:#CCCCCC"><span lang="EN" style="color: black; font-family: 'Courier New'; ">4cbbfAAtVT86zwu1RK7aPFFxuhDR1L6tSoc_BJECPebWKRXjBZCiFV4n3oknjhMs<o:p></o:p></span></p><p class="MsoNormal" style="background:#CCCCCC"><span lang="EN" style="color: black; font-family: 'Courier New'; ">tn64tZ_2W-5JsGY4Hc5n9yBXArwl93lqt7_RN5w6Cf0h4QyQ5v-65YGjQR0_FDW2<o:p></o:p></span></p><p class="MsoNormal" style="background:#CCCCCC"><span lang="EN" style="color: black; font-family: 'Courier New'; ">QvzqY368QQMicAtaSqzs8KJZgnYb9c7d0zgdAZHzu6qMQvRL5hajrn1n91CbOpbI<o:p></o:p></span></p><p class="MsoNormal" style="background:#CCCCCC"><span lang="EN" style="color: black; font-family: 'Courier New'; ">SD08qNLyrdkt-bFTWhAI4vMQFh6WeZu0fM4lFd2NcRwr3XPksINHaQ-G_xBniIqb<o:p></o:p></span></p><p class="MsoNormal" style="background:#CCCCCC"><span lang="EN" style="color: black; font-family: 'Courier New'; ">w0Ls1jF44-csFCur-kEgU8awapJzKnqDKgw",<o:p></o:p></span></p><p class="MsoNormal" style="background:#CCCCCC"><span lang="EN" style="color: black; font-family: 'Courier New'; "> "exp":"AQAB",<o:p></o:p></span></p><p class="MsoNormal" style="background:#CCCCCC"><span lang="EN" style="color: black; font-family: 'Courier New'; "> "kid":"2011-04-29"}<o:p></o:p></span></p><p class="MsoNormal" style="background:#CCCCCC"><span lang="EN" style="color: black; font-family: 'Courier New'; "> ]<o:p></o:p></span></p><p class="MsoNormal" style="background:#CCCCCC"><span lang="EN" style="color: black; font-family: 'Courier New'; ">}<o:p></o:p></span></p><div class="MsoNormal"><a name="anchor3"></a><span style="font-size: 11pt; color: rgb(31, 73, 125); font-family: Calibri, sans-serif; "><o:p> </o:p></span></div><div class="MsoNormal"><span style="font-size: 11pt; color: rgb(31, 73, 125); font-family: Calibri, sans-serif; ">In this example, a single key is specified:<o:p></o:p></span></div><div class="MsoNormal"><span style="font-size: 11pt; color: rgb(31, 73, 125); font-family: Calibri, sans-serif; "><o:p> </o:p></span></div><p class="MsoNormal" style="background:#CCCCCC"><span lang="EN" style="color: black; font-family: 'Courier New'; "> {"alg":"EC",<o:p></o:p></span></p><p class="MsoNormal" style="background:#CCCCCC"><span lang="EN" style="color: black; font-family: 'Courier New'; "> "crv":"P-256",<o:p></o:p></span></p><p class="MsoNormal" style="background:#CCCCCC"><span lang="EN" style="color: black; font-family: 'Courier New'; "> "x":"MKBCTNIcKUSDii11ySs3526iDZ8AiTo7Tu6KPAqv7D4",<o:p></o:p></span></p><p class="MsoNormal" style="background:#CCCCCC"><span lang="EN" style="color: black; font-family: 'Courier New'; "> "y":"4Etl6SRW2YiLUrN5vfvVHuhp7x8PxltmWWlbbM4IFyM",<o:p></o:p></span></p><p class="MsoNormal" style="background:#CCCCCC"><span lang="EN" style="color: black; font-family: 'Courier New'; "> "use":"enc",<o:p></o:p></span></p><p class="MsoNormal" style="background:#CCCCCC"><span lang="EN" style="color: black; font-family: 'Courier New'; "> "kid":"1"}<o:p></o:p></span></p><div class="MsoNormal"><span style="font-size: 11pt; color: rgb(31, 73, 125); font-family: Calibri, sans-serif; "><o:p> </o:p></span></div><div class="MsoNormal"><span style="font-size: 11pt; color: rgb(31, 73, 125); font-family: Calibri, sans-serif; ">The array format is used in contexts such as the key values retrieved for the JWS and JWE “jku” parameter where multiple keys may be specified.
The single key format is used in contexts such as the JWE “epk” parameter, where only a single key value is called for.<o:p></o:p></span></div><div class="MsoNormal"><span style="font-size: 11pt; color: rgb(31, 73, 125); font-family: Calibri, sans-serif; "><o:p> </o:p></span></div><div class="MsoNormal"><span style="font-size: 11pt; color: rgb(31, 73, 125); font-family: Calibri, sans-serif; ">If this isn’t clear, feel free to ask a follow-up question.<o:p></o:p></span></div><div class="MsoNormal"><span style="font-size: 11pt; color: rgb(31, 73, 125); font-family: Calibri, sans-serif; "><o:p> </o:p></span></div><div class="MsoNormal"><span style="font-size: 11pt; color: rgb(31, 73, 125); font-family: Calibri, sans-serif; "> Best wishes,<o:p></o:p></span></div><div class="MsoNormal"><span style="font-size: 11pt; color: rgb(31, 73, 125); font-family: Calibri, sans-serif; "> -- Mike<o:p></o:p></span></div><div class="MsoNormal"><span style="font-size: 11pt; color: rgb(31, 73, 125); font-family: Calibri, sans-serif; "><o:p> </o:p></span></div>
<div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in"><div class="MsoNormal"><b><span style="font-size: 10pt; font-family: Tahoma, sans-serif; ">From:</span></b><span style="font-size: 10pt; font-family: Tahoma, sans-serif; ">
<a href="mailto:openid-specs-ab-bounces@lists.openid.net">openid-specs-ab-bounces@lists.openid.net</a> [<a href="mailto:openid-specs-ab-bounces@lists.openid.net">mailto:openid-specs-ab-bounces@lists.openid.net</a>]
<b>On Behalf Of </b>Dingwell, Robert A.<br>
<b>Sent:</b> Wednesday, June 27, 2012 9:04 AM<br>
<b>To:</b> <a href="mailto:openid-specs-ab@lists.openid.net">openid-specs-ab@lists.openid.net</a><br>
<b>Subject:</b> [Openid-specs-ab] JWK clarification<o:p></o:p></span></div>
</div>
</div><div class="MsoNormal"><o:p> </o:p></div>
<div><div class="MsoNormal"><span style="font-size: 10.5pt; color: black; font-family: Calibri, sans-serif; ">If I remember correctly the initial version of the JWK format specified the format as being an array of keys but the latest version of the JWK spec appears
to have broken that idea out to where there is the key format and set format. <o:p></o:p></span></div>
</div>
<div><div class="MsoNormal"><span style="font-size: 10.5pt; color: black; font-family: Calibri, sans-serif; "><o:p> </o:p></span></div>
</div>
<div><div class="MsoNormal"><span style="font-size: 10.5pt; color: black; font-family: Calibri, sans-serif; ">As both the client and the server have the option of providing signing and encrypting keys in JWK format are the urls for those keys intended to be a single
JWK or a JWK set? Seeing how the specifications states that if both X509 and JWK urls are provided they must be the same key makes me believe that the url would point to a single key. If it is a set how would one determine which key to use in the set considering
that the set could contain a number of keys that are marked as signing or encrypting keys?<o:p></o:p></span></div>
</div>
<div><div class="MsoNormal"><span style="font-size: 10.5pt; color: black; font-family: Calibri, sans-serif; "><o:p> </o:p></span></div>
</div>
<div><div class="MsoNormal"><span style="font-size: 10.5pt; color: black; font-family: Calibri, sans-serif; ">Rob<o:p></o:p></span></div>
</div>
<div><div class="MsoNormal"><span style="font-size: 10.5pt; color: black; font-family: Calibri, sans-serif; "><o:p> </o:p></span></div>
</div>
</div>
</div>
</div>
</span>
</div>
_______________________________________________<br>Openid-specs-ab mailing list<br><a href="mailto:Openid-specs-ab@lists.openid.net">Openid-specs-ab@lists.openid.net</a><br>http://lists.openid.net/mailman/listinfo/openid-specs-ab<br></blockquote></div><br></div></body></html>