<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><br class=""><div><br class=""><blockquote type="cite" class=""><div class="">On 9 Jan 2019, at 17:22, George Fletcher via Openid-specs-ab <<a href="mailto:openid-specs-ab@lists.openid.net" class="">openid-specs-ab@lists.openid.net</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="">Hi,<br class=""><br class="">Since the OIDC dynamic client registration specs were published before the RFCs for OAuth2, there is no mention of the use of software_statements. However, the OIDC flows allow for use of additional parameters. What's not clear to me is how an implementation can be certified for OIDC DCR if it requires software statements.<br class=""><br class="">Also, if the client is going to be a mobile app client and generate a private key locally on the device (or via trusted hardware) it seems that it MUST use the 'jwks' parameter and NOT the 'jwks_uri' parameter. However, the use of the 'jwks' parameter is kind of discouraged by the spec language saying that 'jwks_uri' should be used if possible do to "key rotation not supported" with the 'jwks' parameter.<br class=""><br class="">All this leads to a couple of questions...<br class=""><br class="">1. Is there any best practice recommendations around OIDC dynamic client registration. I'm specifically interested in experience where the mobile app is using a private key generated on the device and/or use of software_statements with OIDC.<br class=""><br class="">2. Why can't the application (once it's registered it's public key) update it's configuration with a new public thus supporting key rotation? It should be able to sign any such update with its existing private key thus making the request secure.<br class=""></div></div></blockquote><br class=""></div><div>This is somewhat akin to what we are proposing for key rotation for trust anchors in the OIDC federation draft so yes is should be possible.</div><br class=""><div class="">
<div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; text-decoration: none;">— Roland</div><div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; text-decoration: none;">Can anything be sadder than work left unfinished? Yes, work never begun. -Christina Rossetti, poet (5 Dec 1830-1894) </div>
</div>
<br class=""></body></html>