<div dir="ltr">I agree that the recipient of a JWT should reject it if it is not the intended audience. <br><br>We think of the "other system" to be another component of the RP -- and because of that, that an id_token is the right token to bind and that both would verify the id_token has the correct "aud" value.<br><br>VCs were designed for the issuer - holder - verifier model to protect the privacy of the user by preventing the issuer from learning about presentation by the holder to a verifier. <br><br><br></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Fri, Sep 26, 2025 at 7:28 PM Andrii Deinega via Openid-specs-ab <<a href="mailto:openid-specs-ab@lists.openid.net" target="_blank">openid-specs-ab@lists.openid.net</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div>I believe that any recipient of a JWT (in this case, an ID Token) should immediately reject it if it isn't the intended audience (which is indicated by the aud claim), regardless of whether cryptographic binding is present or not. This alone makes the statement below too problematic for me.</div><div><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">When an RP wants to prove to another system that it has authenticated a user, it may present the ID Token as a bearer token. However, bearer tokens are vulnerable to theft and replay attacks - if an attacker intercepts the ID Token, they can impersonate the authenticated user to downstream systems that accept a ID Token as a bearer token.</blockquote><div><br></div><div>It's difficult to imagine multiple systems (recipients) sharing the same value in the aud claim (this value must be a client_id of the RP per the Core spec). It's fair to add the aud claim may contain an array with more than one element, but it's also fair to say this practice is discouraged (1) and comes with additional complexity and concerns (2).<br><br>At the end of the day... I see a lot of value, and I see the reason why people want to have the standard around "proving to another system that it has authenticated a user," but I don't think that repurposing existing ID Tokens for it is the right way to go.... I’d suggest, and actually love to see - the use of SD JWT VCs (or other VCs) for this purpose instead.</div><div><br></div><div>I haven’t reached the point where I need to "touch" Justin’s concerns... I fully agree with him on them.<br></div><div><br></div>All the best,<div>Andrii</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Fri, Sep 26, 2025 at 9:05 AM Justin Richer via Openid-specs-ab <<a href="mailto:openid-specs-ab@lists.openid.net" target="_blank">openid-specs-ab@lists.openid.net</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div>
I do not support adoption of this work. The ID Token is not intended to be a conveyable artifact, and using it as such is a security layer boundary. It’s hard enough to get people to not use ID Tokens as Access Tokens today, since a lot of developers see all
JWTs as equivalent, really. This work would make this problem significantly worse.
<div><br>
</div>
<div> — Justin<br id="m_4562045221352760870m_1050963931962241998m_7343970695501230547lineBreakAtBeginningOfMessage">
<div><br>
<blockquote type="cite">
<div>On Sep 15, 2025, at 6:57 PM, Michael Jones via Openid-specs-ab <<a href="mailto:openid-specs-ab@lists.openid.net" target="_blank">openid-specs-ab@lists.openid.net</a>> wrote:</div>
<br>
<div>
<div style="font-family:Helvetica;font-size:12px;font-style:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;text-decoration:none">
<div style="margin:0in;font-size:12pt;font-family:Aptos,sans-serif"><span style="font-size:11pt">This starts a two-week call for feedback on whether to adopt the OpenID Connect OpenID Connect Key Binding specification contributed to the working group
by Dick Hardt and Ethan Heilman as an OpenID Connect Working Group specification. Please reply-all by Monday, September 29, 2025 saying whether you are favor of adoption or not, also saying why.<u></u><u></u></span></div>
<div style="margin:0in;font-size:12pt;font-family:Aptos,sans-serif"><span style="font-size:11pt"><u></u> <u></u></span></div>
<div style="margin:0in;font-size:12pt;font-family:Aptos,sans-serif"><span style="font-size:11pt">The specification was contributed at<span> </span><a href="https://lists.openid.net/pipermail/openid-specs-ab/2025-August/010890.html" style="color:rgb(70,120,134);text-decoration:underline" target="_blank">https://lists.openid.net/pipermail/openid-specs-ab/2025-August/010890.html</a>.
It has been extensively discussed by the working group both on calls and on the mailing list. From my observations of the discussion as a working group chair, I believe that there is consensus that it would be useful to have a standard solving the problem
addressed by this specification.<u></u><u></u></span></div>
<div style="margin:0in;font-size:12pt;font-family:Aptos,sans-serif"><span style="font-size:11pt"><u></u> <u></u></span></div>
<div style="margin:0in;font-size:12pt;font-family:Aptos,sans-serif"><span style="font-size:11pt"> Writing as a working group chair,<u></u><u></u></span></div>
<div style="margin:0in;font-size:12pt;font-family:Aptos,sans-serif"><span style="font-size:11pt"> -- Mike<u></u><u></u></span></div>
<div style="margin:0in;font-size:12pt;font-family:Aptos,sans-serif"><span style="font-size:11pt"><u></u> <u></u></span></div>
</div>
<span style="font-family:Helvetica;font-size:12px;font-style:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;text-decoration:none;float:none;display:inline">_______________________________________________</span><br style="font-family:Helvetica;font-size:12px;font-style:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;text-decoration:none">
<span style="font-family:Helvetica;font-size:12px;font-style:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;text-decoration:none;float:none;display:inline">Openid-specs-ab
mailing list</span><br style="font-family:Helvetica;font-size:12px;font-style:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;text-decoration:none">
<a href="mailto:Openid-specs-ab@lists.openid.net" style="color:rgb(70,120,134);text-decoration:underline;font-family:Helvetica;font-size:12px;font-style:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px" target="_blank">Openid-specs-ab@lists.openid.net</a><br style="font-family:Helvetica;font-size:12px;font-style:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;text-decoration:none">
<a href="https://lists.openid.net/mailman/listinfo/openid-specs-ab" style="color:rgb(70,120,134);text-decoration:underline;font-family:Helvetica;font-size:12px;font-style:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px" target="_blank">https://lists.openid.net/mailman/listinfo/openid-specs-ab</a></div>
</blockquote>
</div>
<br>
</div>
</div>
_______________________________________________<br>
Openid-specs-ab mailing list<br>
<a href="mailto:Openid-specs-ab@lists.openid.net" target="_blank">Openid-specs-ab@lists.openid.net</a><br>
<a href="https://lists.openid.net/mailman/listinfo/openid-specs-ab" rel="noreferrer" target="_blank">https://lists.openid.net/mailman/listinfo/openid-specs-ab</a><br>
</blockquote></div>
_______________________________________________<br>
Openid-specs-ab mailing list<br>
<a href="mailto:Openid-specs-ab@lists.openid.net" target="_blank">Openid-specs-ab@lists.openid.net</a><br>
<a href="https://lists.openid.net/mailman/listinfo/openid-specs-ab" rel="noreferrer" target="_blank">https://lists.openid.net/mailman/listinfo/openid-specs-ab</a><br>
</blockquote></div>