<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;">Hi Dick,<div><br></div><div>I’m a little confused by ‘bound_key’ as the purpose of the scope is not to create a “bound key” but rather to bind a key to a token and more specifically the id_token. When I think of scopes like ‘openid’ or ‘profile’ I generally have a decent idea of the intent of the scope. Would ‘bound_token’ work? The intended result is a bound token?</div><div><br id="lineBreakAtBeginningOfMessage"><div>
<div>George Fletcher</div><div>Identity Standards Architect</div><div>Practical Identity LLC</div><div><br></div><br class="Apple-interchange-newline">
</div>
<div><br><blockquote type="cite"><div>On Sep 4, 2025, at 12:44 PM, Dick Hardt <dick.hardt@gmail.com> wrote:</div><br class="Apple-interchange-newline"><div><div dir="ltr">I'm going to update the name of the scope in the doc to be "bound_key" unless there is opposition to it / or someone has a suggestion they prefer for us to discuss!</div><br><div class="gmail_quote gmail_quote_container"><div dir="ltr" class="gmail_attr">On Sat, Aug 30, 2025 at 11:07 AM Dick Hardt <<a href="mailto:dick.hardt@gmail.com">dick.hardt@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr">"bound_key" is crisper and says what is wanted in the token rather than what is to be done </div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Fri, Aug 29, 2025 at 6:51 PM Dag Helge Østerhagen via Openid-specs-ab <<a href="mailto:openid-specs-ab@lists.openid.net" target="_blank">openid-specs-ab@lists.openid.net</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div>
<div dir="ltr" style="font-family:Aptos,Aptos_MSFontService,-apple-system,Roboto,Arial,Helvetica,sans-serif;font-size:12pt">
+1 for both "key_binding" and "cnf". Sigh.</div>
<div dir="ltr" style="font-family:Aptos,Aptos_MSFontService,-apple-system,Roboto,Arial,Helvetica,sans-serif;font-size:12pt">
<br>
</div>
<div dir="ltr" style="font-family:Aptos,Aptos_MSFontService,-apple-system,Roboto,Arial,Helvetica,sans-serif;font-size:12pt">
/dag</div>
<div id="m_-5578241991447677159m_5681901780641165081ms-outlook-mobile-body-separator-line" dir="ltr"><span style="font-family:Aptos,Aptos_MSFontService,-apple-system,Roboto,Arial,Helvetica,sans-serif;font-size:12pt"></span></div>
<div id="m_-5578241991447677159m_5681901780641165081ms-outlook-mobile-signature" dir="ltr"></div>
<hr style="display:inline-block;width:98%">
<div id="m_-5578241991447677159m_5681901780641165081divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt"><b>From:</b> Dick Hardt <<a href="mailto:dick.hardt@gmail.com" target="_blank">dick.hardt@gmail.com</a>><br>
<b>Sent:</b> Friday, August 29, 2025 7:47:45 PM<br>
<b>To:</b> Artifact Binding/Connect Working Group <<a href="mailto:openid-specs-ab@lists.openid.net" target="_blank">openid-specs-ab@lists.openid.net</a>><br>
<b>Cc:</b> Dag Helge Østerhagen <<a href="mailto:dag@udelt.no" target="_blank">dag@udelt.no</a>>; <a href="mailto:george@practicalidentity.com" target="_blank">george@practicalidentity.com</a> <<a href="mailto:george@practicalidentity.com" target="_blank">george@practicalidentity.com</a>>; Filip Skokan <<a href="mailto:panva.ip@gmail.com" target="_blank">panva.ip@gmail.com</a>><br>
<b>Subject:</b> Re: [Openid-specs-ab] Key-binding and dpop scope</font>
<div> </div>
</div>
<div>
<div dir="ltr">`key_binding` as scope name?</div>
<br>
<div>
<div dir="ltr">On Fri, Aug 29, 2025 at 6:35 PM Dag Helge Østerhagen via Openid-specs-ab <<a href="mailto:openid-specs-ab@lists.openid.net" target="_blank">openid-specs-ab@lists.openid.net</a>> wrote:<br>
</div>
<blockquote style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div>
<div dir="ltr" style="font-family:Aptos,Aptos_MSFontService,-apple-system,Roboto,Arial,Helvetica,sans-serif;font-size:12pt">
Well, currently the dpop header is used to signal token binding (and inclusion of the cnf claim) for access and refresh tokens. I don't see any other use cases in the (near) future.</div>
<div dir="ltr" style="font-family:Aptos,Aptos_MSFontService,-apple-system,Roboto,Arial,Helvetica,sans-serif;font-size:12pt">
<br>
</div>
<div dir="ltr" style="font-family:Aptos,Aptos_MSFontService,-apple-system,Roboto,Arial,Helvetica,sans-serif;font-size:12pt">
/dag</div>
<div id="m_-5578241991447677159m_5681901780641165081x_m_7352857248605215566ms-outlook-mobile-body-separator-line" dir="ltr">
</div>
<div id="m_-5578241991447677159m_5681901780641165081x_m_7352857248605215566ms-outlook-mobile-signature" dir="ltr"></div>
<hr style="display:inline-block;width:98%">
<div id="m_-5578241991447677159m_5681901780641165081x_m_7352857248605215566divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt"><b>From:</b>
<a href="mailto:george@practicalidentity.com" target="_blank">george@practicalidentity.com</a> <<a href="mailto:george@practicalidentity.com" target="_blank">george@practicalidentity.com</a>><br>
<b>Sent:</b> Friday, August 29, 2025 7:01:54 PM<br>
<b>To:</b> Artifact Binding/Connect Working Group <<a href="mailto:openid-specs-ab@lists.openid.net" target="_blank">openid-specs-ab@lists.openid.net</a>><br>
<b>Cc:</b> Dag Helge Østerhagen <<a href="mailto:dag@udelt.no" target="_blank">dag@udelt.no</a>><br>
<b>Subject:</b> Re: [Openid-specs-ab] Key-binding and dpop scope</font>
<div> </div>
</div>
<div>My thought is that might depend on whether the ‘cnf’ scope is only applied to the id_token or whether cnf claims should be added to other issued tokens as well. Currently the proposed key-binding spec is specific to id_tokens.
<div><br id="m_-5578241991447677159m_5681901780641165081x_m_7352857248605215566x_lineBreakAtBeginningOfMessage">
<div>
<div>George Fletcher</div>
<div>Identity Standards Architect</div>
<div>Practical Identity LLC</div>
<div><br>
</div>
<br>
</div>
<div><br>
<blockquote type="cite">
<div>On Aug 29, 2025, at 12:56 PM, Dag Helge Østerhagen via Openid-specs-ab <<a href="mailto:openid-specs-ab@lists.openid.net" target="_blank">openid-specs-ab@lists.openid.net</a>> wrote:</div>
<br>
<div>
<div>
<div dir="ltr" style="font-family:Aptos,Aptos_MSFontService,-apple-system,Roboto,Arial,Helvetica,sans-serif;font-size:12pt">
I like «id_token_cnf», but wouldn’t just «cnf» be more aligned with other oidc scopes?</div>
<div dir="ltr" style="font-family:Aptos,Aptos_MSFontService,-apple-system,Roboto,Arial,Helvetica,sans-serif;font-size:12pt">
<br>
</div>
<div dir="ltr" style="font-family:Aptos,Aptos_MSFontService,-apple-system,Roboto,Arial,Helvetica,sans-serif;font-size:12pt">
/dag</div>
<div id="m_-5578241991447677159m_5681901780641165081x_m_7352857248605215566x_ms-outlook-mobile-body-separator-line" dir="ltr">
</div>
<div id="m_-5578241991447677159m_5681901780641165081x_m_7352857248605215566x_ms-outlook-mobile-signature" dir="ltr"></div>
<hr style="display:inline-block;width:98%">
<div id="m_-5578241991447677159m_5681901780641165081x_m_7352857248605215566x_divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt"><b>From:</b> Openid-specs-ab <<a href="mailto:openid-specs-ab-bounces@lists.openid.net" target="_blank">openid-specs-ab-bounces@lists.openid.net</a>>
on behalf of george--- via Openid-specs-ab <<a href="mailto:openid-specs-ab@lists.openid.net" target="_blank">openid-specs-ab@lists.openid.net</a>><br>
<b>Sent:</b> Friday, August 29, 2025 6:14:16 PM<br>
<b>To:</b> Dick Hardt <<a href="mailto:dick.hardt@hello.coop" target="_blank">dick.hardt@hello.coop</a>><br>
<b>Cc:</b> <a href="mailto:george@practicalidentity.com" target="_blank">george@practicalidentity.com</a> <<a href="mailto:george@practicalidentity.com" target="_blank">george@practicalidentity.com</a>>; Artifact Binding/Connect Working Group <<a href="mailto:openid-specs-ab@lists.openid.net" target="_blank">openid-specs-ab@lists.openid.net</a>><br>
<b>Subject:</b> Re: [Openid-specs-ab] Key-binding and dpop scope</font>
<div> </div>
</div>
<div>That makes sense to me; including ‘cnf’ in the scope name. Would we ever want to allow the “key binding” mechanism to use something other than DPoP? If so, and the express purpose is to provide key binding for the id_token, then I’d recommend something
like ‘id_token_cnf’. It’s specific, clear and doesn’t preclude methods other than DPoP to provide the necessary data for the cnf claim.
<div><br id="m_-5578241991447677159m_5681901780641165081x_m_7352857248605215566x_x_lineBreakAtBeginningOfMessage">
<div>
<div>George Fletcher</div>
<div>Identity Standards Architect</div>
<div>Practical Identity LLC</div>
<div><br>
</div>
<br>
</div>
<div><br>
<blockquote type="cite">
<div>On Aug 29, 2025, at 11:00 AM, Dick Hardt <<a href="mailto:dick.hardt@hello.coop" target="_blank">dick.hardt@hello.coop</a>> wrote:</div>
<br>
<div>
<div dir="ltr">
<div style="font-size:small">I have no strong views on the scope name. Open to other ideas / suggestions / opinions!<br>
<br>
Perhaps `cnf` to align with the claim? </div>
</div>
<div hspace="streak-pt-mark" style="max-height:1px"><img alt="" src="https://mailfoogae.appspot.com/t?sender=aZGljay5oYXJkdEBoZWxsby5jb29w&type=zerocontent&guid=1070e26b-08ab-4363-bf02-caa82d63577d" style="width: 0px; max-height: 0px; overflow: hidden;"><font color="#ffffff" size="1">ᐧ</font></div>
<br>
<div>
<div dir="ltr">On Fri, Aug 29, 2025 at 3:57 PM <<a href="mailto:george@practicalidentity.com" target="_blank">george@practicalidentity.com</a>> wrote:<br>
</div>
<blockquote style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div>
<div>Hi, </div>
<div><br>
</div>
<div>Would it make sense to change the scope name identified in the key-binding spec from something specific like ‘dpop’ to something more generic? e.g. ‘id_token_kb’ ? Or maybe just make clearer that the RP is looking for key bound tokens? e.g. ‘dpop_kb’?
I just worry that ‘dpop’ by itself does not communicate the intended behavior.</div>
<div><br>
</div>
<div>Thoughts?</div>
<br>
<div>
<div>George Fletcher</div>
<div>Identity Standards Architect</div>
<div>Practical Identity LLC</div>
<div><br>
</div>
<br>
</div>
<br>
</div>
</blockquote>
</div>
</div>
</blockquote>
</div>
<br>
</div>
</div>
</div>
_______________________________________________<br>
Openid-specs-ab mailing list<br>
<a href="mailto:Openid-specs-ab@lists.openid.net" target="_blank">Openid-specs-ab@lists.openid.net</a><br>
<a href="https://lists.openid.net/mailman/listinfo/openid-specs-ab" target="_blank">https://lists.openid.net/mailman/listinfo/openid-specs-ab</a><br>
</div>
</blockquote>
</div>
<br>
</div>
</div>
</div>
_______________________________________________<br>
Openid-specs-ab mailing list<br>
<a href="mailto:Openid-specs-ab@lists.openid.net" target="_blank">Openid-specs-ab@lists.openid.net</a><br>
<a href="https://lists.openid.net/mailman/listinfo/openid-specs-ab" rel="noreferrer" target="_blank">https://lists.openid.net/mailman/listinfo/openid-specs-ab</a><br>
</blockquote>
</div>
</div>
</div>
_______________________________________________<br>
Openid-specs-ab mailing list<br>
<a href="mailto:Openid-specs-ab@lists.openid.net" target="_blank">Openid-specs-ab@lists.openid.net</a><br>
<a href="https://lists.openid.net/mailman/listinfo/openid-specs-ab" rel="noreferrer" target="_blank">https://lists.openid.net/mailman/listinfo/openid-specs-ab</a><br>
</blockquote></div>
</blockquote></div>
</div></blockquote></div><br></div></body></html>