<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body>
<div dir="ltr" style="font-family: Aptos, Aptos_MSFontService, -apple-system, Roboto, Arial, Helvetica, sans-serif; font-size: 12pt;">
I like «id_token_cnf», but wouldn’t just «cnf» be more aligned with other oidc scopes?</div>
<div dir="ltr" style="font-family: Aptos, Aptos_MSFontService, -apple-system, Roboto, Arial, Helvetica, sans-serif; font-size: 12pt;">
<br>
</div>
<div dir="ltr" style="font-family: Aptos, Aptos_MSFontService, -apple-system, Roboto, Arial, Helvetica, sans-serif; font-size: 12pt;">
/dag</div>
<div id="ms-outlook-mobile-body-separator-line" dir="ltr"></div>
<div id="ms-outlook-mobile-signature" dir="ltr"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> Openid-specs-ab <openid-specs-ab-bounces@lists.openid.net> on behalf of george--- via Openid-specs-ab <openid-specs-ab@lists.openid.net><br>
<b>Sent:</b> Friday, August 29, 2025 6:14:16 PM<br>
<b>To:</b> Dick Hardt <dick.hardt@hello.coop><br>
<b>Cc:</b> george@practicalidentity.com <george@practicalidentity.com>; Artifact Binding/Connect Working Group <openid-specs-ab@lists.openid.net><br>
<b>Subject:</b> Re: [Openid-specs-ab] Key-binding and dpop scope</font>
<div> </div>
</div>
<div style="line-break:after-white-space">That makes sense to me; including ‘cnf’ in the scope name. Would we ever want to allow the “key binding” mechanism to use something other than DPoP? If so, and the express purpose is to provide key binding for the id_token,
then I’d recommend something like ‘id_token_cnf’. It’s specific, clear and doesn’t preclude methods other than DPoP to provide the necessary data for the cnf claim.
<div><br id="x_lineBreakAtBeginningOfMessage">
<div>
<div>George Fletcher</div>
<div>Identity Standards Architect</div>
<div>Practical Identity LLC</div>
<div><br>
</div>
<br class="x_Apple-interchange-newline">
</div>
<div><br>
<blockquote type="cite">
<div>On Aug 29, 2025, at 11:00 AM, Dick Hardt <dick.hardt@hello.coop> wrote:</div>
<br class="x_Apple-interchange-newline">
<div>
<div dir="ltr">
<div class="x_gmail_default" style="font-size:small">I have no strong views on the scope name. Open to other ideas / suggestions / opinions!<br>
<br>
Perhaps `cnf` to align with the claim? </div>
</div>
<div hspace="streak-pt-mark" style="max-height:1px"><img alt="" src="https://mailfoogae.appspot.com/t?sender=aZGljay5oYXJkdEBoZWxsby5jb29w&type=zerocontent&guid=1070e26b-08ab-4363-bf02-caa82d63577d" style="width:0px; max-height:0px; overflow:hidden"><font color="#ffffff" size="1">ᐧ</font></div>
<br>
<div class="x_gmail_quote x_gmail_quote_container">
<div dir="ltr" class="x_gmail_attr">On Fri, Aug 29, 2025 at 3:57 PM <<a href="mailto:george@practicalidentity.com">george@practicalidentity.com</a>> wrote:<br>
</div>
<blockquote class="x_gmail_quote" style="margin:0px 0px 0px 0.8ex; border-left:1px solid rgb(204,204,204); padding-left:1ex">
<div>
<div>Hi, </div>
<div><br>
</div>
<div>Would it make sense to change the scope name identified in the key-binding spec from something specific like ‘dpop’ to something more generic? e.g. ‘id_token_kb’ ? Or maybe just make clearer that the RP is looking for key bound tokens? e.g. ‘dpop_kb’?
I just worry that ‘dpop’ by itself does not communicate the intended behavior.</div>
<div><br>
</div>
<div>Thoughts?</div>
<br>
<div>
<div>George Fletcher</div>
<div>Identity Standards Architect</div>
<div>Practical Identity LLC</div>
<div><br>
</div>
<br>
</div>
<br>
</div>
</blockquote>
</div>
</div>
</blockquote>
</div>
<br>
</div>
</div>
</body>
</html>