<html><head><style type="text/css"><!-- DIV {margin:0px;} --></style></head><body><div style="font-family:tahoma,new york,times,serif;font-size:10pt;color:#000000;"><div><div>Spec call notes 07-Jan-13<br><br>John Bradley<br>Edmund Jay<br>Mike Jones<br>Brian Campbell<br><br><br><br>Agenda<br> - Editing Status<br> - Issues<br><br><br>Editing Status<br> Justin has checked in changes for Registration spec to keep it aligned with IETF OAuth2 Dynamic Registration. John will review.<br> Mike will apply Session Management changes as agreed upon at the last IIW meeting within the next day or so for review.<br> Mike will also write the Mandatory To Implement language for servers.<br><br> John and Brian has discussed the problems regarding the x5u parameter and multiple X509 certificates.<br> There is no way to provider certificate
rollovers.<br> It might be possible if the specs allow multiple x5u's with a key id (kid), but current specs only allow one.<br> Another solution is to somehow detect key changes via key id (kid). Key id must be unique for each key and provide guidance for kid format.<br> Mike may bring up issue in the JOSE working group.<br> JWK allows multiple keys so this is not a problem if using jku.<br> John will file 2 new bugs :<br> a) How to deal with key rollovers<br> b) How to deal with multiple keys with x5u<br><br><br>Issues<br> John will try and finish issues #684, 657, 637, 620, 521 for implementer's draft.<br> 619 and 601 are done and needs review.<br> 648 will be put on low priority.<br><br> 605 reassigned to
Mike.<br> And Security Considerations for the discovery's ETA is still unknown. <br><br><br> <br></div></div>
</div></body></html>