<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN">
<html><body style='font-family: Verdana,Geneva,sans-serif'>
<p>Hi Joseph,</p>
<p>I agree that the OpenID Connect errata should include the referred definition in RFC7515, and FAPI Part 1 and 2 should include RFC7515 as well as RFC7516, RFC7517, RFC7518, and RFC7519 in the clause 3. As far as FAPI is concerned, RFC7515 should be included in the normative reference as well, though it is included indirectly through OIDC already. </p>
<p>The precedence of the referencing is Normative Reference > Definition in the document series > Author Intention > Other Standards.</p>
<p>OpenID Connect does not reference RFC4648 but normatively references RFC7515 (as JWS). So, clearly, the definition in RFC7515 takes a precedence over that of RFC4648. </p>
<p>Best, </p>
<div>
<pre>---<br />Nat Sakimura
Research Fellow, Nomura Research Institute
Chairman of the Board, OpenID Foundation</pre>
</div>
<p>On 2018-02-07 04:24, Joseph Heenan wrote:</p>
<blockquote type="cite" style="padding-left:5px; border-left:#1010ff 2px solid; margin-left:5px"><!-- html ignored --><!-- head ignored --><!-- meta ignored -->Hi Nat,
<div> </div>
<div>Thanks. I agree it is defined there, but OIDC Core doesn't appear to state that this is the definition it is using!</div>
<div> </div>
<div>(It is unhelpful that RFC7515 and RFC4648 both define the term 'base64url', but in different ways.)</div>
<div> </div>
<div>Joseph</div>
<div><br />
<div><br />
<blockquote type="cite" style="padding-left:5px; border-left:#1010ff 2px solid; margin-left:5px">
<div>On 7 Feb 2018, at 12:07, Nat Sakimura <<a href="mailto:nat@sakimura.org">nat@sakimura.org</a>> wrote:</div>
<br class="Apple-interchange-newline" />
<div>
<div>
<div style="direction: ltr; margin: 0px; padding: 0px; font-family: sans-serif; font-size: 11pt;" dir="auto">It is defined in RFC7515<br /><br /></div>
<div style="direction: ltr; margin: 0px; padding: 0px; font-family: sans-serif; font-size: 11pt;" dir="auto">Quote: <br /><br /></div>
<div style="direction: ltr; margin: 0px; padding: 0px; font-family: sans-serif; font-size: 11pt;" dir="auto">Base64url Encoding </div>
<div style="direction: ltr; margin: 0px; padding: 0px; font-family: sans-serif; font-size: 11pt;" dir="auto">Base64 encoding using the URL- and filename-safe character set defined in Section 5 of RFC 4648 [RFC4648], with all trailing '=' characters omitted (as permitted by Section 3.2) and without the inclusion of any line breaks, whitespace, or other additional characters. Note that the base64url encoding of the empty octet sequence is the empty string. (See Appendix C for notes on implementing base64url encoding without padding.) <br /><br /><br /></div>
<div style="direction: ltr; margin: 0px; padding: 0px; font-family: sans-serif; font-size: 11pt;" dir="auto">
<div style="direction: ltr; margin: 0px; padding: 0px; font-family: sans-serif; font-size: 11pt;" dir="auto"><a href="https://aka.ms/ghei36">Outlook for Android</a> γγεεΎ</div>
</div>
<br /><br /><br />
<div class="gmail_quote">On Wed, Feb 7, 2018 at 9:56 AM +0900, "Joseph Heenan" <span><<a href="mailto:joseph@authlete.com">joseph@authlete.com</a>></span> wrote:<br /><br />
<blockquote class="gmail_quote" style="margin: 0 0 0 .8ex; border-left: 1px #ccc solid; padding-left: 1ex;">
<div dir="3D"ltr"">Hi Nat,
<div> </div>
<div>As per discussion on the FAPI WG call, I'm struggling to understand where in the specs it says that the base64url encoding of s_hash (and c_hash and at_hash) are not padded with '='.</div>
<div> </div>
<div>I fully accept that for all practical purposes these should not be padded, but I can't find where in the specs it says that. One vendor is padding s_hash and believes they are compliant with the spec as written.</div>
<div> </div>
<div><a href="http://openid.net/specs/openid-connect-core-1_0.html">http://openid.net/specs/openid-connect-core-1_0.html</a> says simply "base64url encoded". It doesn't appear to reference any specific spec for base64url.</div>
<div> </div>
<div>The canonical reference for base64url is I believe <a href="https://tools.ietf.org/html/rfc4648#section-5">https://tools.ietf.org/html/rfc4648#section-5</a></div>
<div> </div>
<div>This states:</div>
<div> </div>
<div>
<blockquote type="cite" style="padding-left:5px; border-left:#1010ff 2px solid; margin-left:5px">
<pre class="newpage" style="font-size: 13.333333015441895px; margin-top: 0px; margin-bottom: 0px; break-before: page;"> The pad character "=" is typically percent-encoded when used in an
URI [<a title=""Uniform Resource Identifier (URI): Generic Syntax"" href="https://tools.ietf.org/html/rfc4648#ref-9">9</a>], but if the data length is known implicitly, this can be
avoided by skipping the padding; see <a href="https://tools.ietf.org/html/rfc4648#section-3.2">section 3.2</a>.
</pre>
</blockquote>
</div>
<div>
<pre class="newpage" style="font-size: 13.333333015441895px; margin-top: 0px; margin-bottom: 0px; break-before: page;"> </pre>
<div style="font-family: Helvetica; font-size: 12px; white-space: normal;">and section 3.2 states:</div>
<div style="font-family: Helvetica; font-size: 12px; white-space: normal;"> </div>
<div style="font-family: Helvetica; font-size: 12px; white-space: normal;">
<blockquote type="cite" style="padding-left:5px; border-left:#1010ff 2px solid; margin-left:5px">
<pre class="newpage" style="font-size: 13.333333015441895px; margin-top: 0px; margin-bottom: 0px; break-before: page;"> Implementations MUST include appropriate pad characters at the end of
encoded data unless the specification referring to this document
explicitly states otherwise.
</pre>
</blockquote>
<div>
<pre class="newpage" style="font-size: 13.333333015441895px; margin-top: 0px; margin-bottom: 0px; break-before: page;"> </pre>
</div>
</div>
<div style="font-family: Helvetica; font-size: 12px; white-space: normal;">This clearly states the value should be padded, as OIDC does not explicitly say padding should be skipped.</div>
<div style="font-family: Helvetica; font-size: 12px; white-space: normal;"> </div>
<div style="font-family: Helvetica; font-size: 12px; white-space: normal;">I searched further and found <a href="https://tools.ietf.org/html/rfc7515">https://tools.ietf.org/html/rfc7515</a>. This does explicitly state:</div>
<div style="font-family: Helvetica; font-size: 12px; white-space: normal;"> </div>
<div style="font-family: Helvetica; font-size: 12px; white-space: normal;">
<blockquote type="cite" style="padding-left:5px; border-left:#1010ff 2px solid; margin-left:5px">
<pre class="newpage" style="font-size: 13.333333015441895px; margin-top: 0px; margin-bottom: 0px; break-before: page;"> Base64url Encoding
Base64 encoding using the URL- and filename-safe character set
defined in <a href="https://tools.ietf.org/html/rfc4648#section-5">Section 5 of RFC 4648</a> [<a title=""The Base16, Base32, and Base64 Data Encodings"" href="https://tools.ietf.org/html/rfc4648">RFC4648</a>], with all trailing '='
characters omitted (as permitted by <a href="https://tools.ietf.org/html/rfc7515#section-3.2">Section 3.2</a>) and without the
inclusion of any line breaks, whitespace, or other additional
characters. Note that the base64url encoding of the empty octet
sequence is the empty string. (See <a href="https://tools.ietf.org/html/rfc7515#appendix-C">Appendix C</a> for notes on
implementing base64url encoding without padding.)
</pre>
</blockquote>
<div>
<pre class="newpage" style="font-size: 13.333333015441895px; margin-top: 0px; margin-bottom: 0px; break-before: page;"> </pre>
<pre class="newpage" style="font-size: 13.333333015441895px; margin-top: 0px; margin-bottom: 0px; break-before: page;"> </pre>
<div style="font-family: Helvetica; font-size: 12px; white-space: normal;">So it appears we have two RFCs, which defines base64url differently.</div>
<div style="font-family: Helvetica; font-size: 12px; white-space: normal;"> </div>
<div style="font-family: Helvetica; font-size: 12px; white-space: normal;">OIDC Core does not appear to explicitly state which definition of base64url it is using - can you point at anything I've missed?</div>
<div style="font-family: Helvetica; font-size: 12px; white-space: normal;"> </div>
<div style="font-family: Helvetica; font-size: 12px; white-space: normal;">I think perhaps the FAPI definition of s_hash should explicitly reference rfc7515's definition.</div>
<div style="font-family: Helvetica; font-size: 12px; white-space: normal;"> </div>
<div style="font-family: Helvetica; font-size: 12px; white-space: normal;">Thanks</div>
<div style="font-family: Helvetica; font-size: 12px; white-space: normal;"> </div>
<div style="font-family: Helvetica; font-size: 12px; white-space: normal;">Joseph</div>
<div style="font-family: Helvetica; font-size: 12px; white-space: normal;"> </div>
<div> </div>
</div>
</div>
</div>
</div>
</blockquote>
</div>
</div>
</div>
</blockquote>
</div>
</div>
</blockquote>
</body></html>