<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"Segoe UI";
panose-1:2 11 5 2 4 2 4 2 2 3;}
@font-face
{font-family:Webdings;
panose-1:5 3 1 2 1 5 9 6 7 3;}
@font-face
{font-family:"Arial Narrow";
panose-1:2 11 6 6 2 2 2 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-GB" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Hi Brian,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Around a year ago at least, must JWT libraries did not honour the ‘b64’ header (they simply ignored it). As a result, we ended up with signatures in the ecosystem where participants thought they
were unencoded, but actually were and verification methods where they were trying to verify against un-encoded payloads. As you can imagine, it just caused a lot of confusion.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">We paused the implemented under a waiver which expired a few months ago and we are beginning to see very few issues with usage of signatures in the ecosystem (after an initial round of incorrect
implementations that have largely been fixed). TBH, payment volumes are low, but increasing and we haven’t seen a similar increase in support tickets or complaints around signature generation and validation.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">The approach that is now followed is to b64 encode and sign the HTTP body, then drop the central part of the resulting JWT (as described in Appendix F).
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span lang="EN-US">From:</span></b><span lang="EN-US"> Brian Campbell <bcampbell@pingidentity.com>
<br>
<b>Sent:</b> 18 September 2020 20:53<br>
<b>To:</b> FAPI Working Group List <openid-specs-fapi@lists.openid.net><br>
<b>Cc:</b> Chris Michael <Chris.Michael@openbanking.org.uk>; Ralph Bragg (raidiam) <ralph.bragg@raidiam.com>; Freddi Gyara <Freddi.Gyara@openbanking.org.uk><br>
<b>Subject:</b> External : Re: [Openid-specs-fapi] External : FW: OBE JWS Profile - Version 0.10b for Approval<o:p></o:p></span></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">Apologies for not being up to date on everything but what were the issues with RFC 7797 b64 header? And how do things work without it? Does that mean the http body has to base64url encoded? Or am I misunderstanding something?<o:p></o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">On Thu, Sep 17, 2020 at 3:06 AM Freddi Gyara via Openid-specs-fapi <<a href="mailto:openid-specs-fapi@lists.openid.net">openid-specs-fapi@lists.openid.net</a>> wrote:<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-right:0cm">
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">I want to raise a concern about “REQUIREMENT-2: The JWS header shall include b64 header parameter, as defined in RFC 7797 [3], set to false."<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">This is a breaking change from the signatures at Open Banking (which explicitly do not use this as we found that library support and interop issues that ensued as a result.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">It would be good to understand the rationale for requiring this flag. If this was included to be aligned with OBIE, the situation on the ground has now actually changed.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Requirements in 5.3.2 are also a breaking change for OBIE (we rely on using `kid` alone to identify the signing key).<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<div>
<div style="border:none;border-top:solid windowtext 1.0pt;padding:3.0pt 0cm 0cm 0cm;border-color:currentcolor currentcolor">
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><b><span lang="EN-US">From:</span></b><span lang="EN-US"> Openid-specs-fapi <<a href="mailto:openid-specs-fapi-bounces@lists.openid.net" target="_blank">openid-specs-fapi-bounces@lists.openid.net</a>>
<b>On Behalf Of </b>Ralph Bragg via Openid-specs-fapi<br>
<b>Sent:</b> 16 September 2020 17:43<br>
<b>To:</b> <a href="mailto:openid-specs-fapi@lists.openid.net" target="_blank">openid-specs-fapi@lists.openid.net</a><br>
<b>Cc:</b> Ralph Bragg (raidiam) <<a href="mailto:ralph.bragg@raidiam.com" target="_blank">ralph.bragg@raidiam.com</a>><br>
<b>Subject:</b> External : [Openid-specs-fapi] FW: OBE JWS Profile - Version 0.10b for Approval</span><o:p></o:p></p>
</div>
</div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">FYI – speak now or forever hold your peace.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Kind Regads,<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Ralph<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<div style="border:none;border-top:solid windowtext 1.0pt;padding:3.0pt 0cm 0cm 0cm;border-color:currentcolor currentcolor">
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><b><span style="font-size:12.0pt;color:black">From:
</span></b><span style="font-size:12.0pt;color:black">Joao Daniel Parracho <<a href="mailto:j.parracho@openbankingeurope.eu" target="_blank">j.parracho@openbankingeurope.eu</a>><br>
<b>Date: </b>Wednesday, 16 September 2020 at 17:27<br>
<b>Cc: </b>Nick Pope <<a href="mailto:nick.pope@openbankingeurope.eu" target="_blank">nick.pope@openbankingeurope.eu</a>>, "John Broxis (<a href="mailto:j.broxis@preta.eu" target="_blank">j.broxis@preta.eu</a>)" <<a href="mailto:j.broxis@preta.eu" target="_blank">j.broxis@preta.eu</a>><br>
<b>Subject: </b>OBE JWS Profile - Version 0.10b for Approval</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
</div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Dear Colleagues,<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">OBE is pleased to distribute the OBE JWS Profile version 0.10b for your approval. This has minor changes from the version 0.0.9 distributed earlier this year as listed in the document
“Comments on OBE JWS profile v 0.9” and with specific revisions shown in document “PRETA-OBE-ID-000-010b-OBE JWS- proposed final draft for approval-with revs”.
<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">It is proposed to finalise this approval at a meeting API and ETSI signature format experts on 22nd October at 15:00 CEST. Can you let us known if you approve or have any remaining
concerns with this document <b>at least 1 week before this meeting date</b>? Also, if you wish to attend the meeting on 22nd October and are unable to make this date please let us know as soon as possible.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Kind regards,<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">João<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;text-align:justify;background:white;background-attachment:scroll;background-position-x:0%;background-position-y:0%">
<b><span lang="DE" style="font-size:10.5pt;font-family:"Arial",sans-serif;color:#1B4B68">João Parracho</span></b><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;text-align:justify;background:white;background-attachment:scroll;background-position-x:0%;background-position-y:0%">
<b><span lang="DE" style="font-size:10.0pt;font-family:"Arial Narrow",sans-serif;color:#1B4B68">Communications & Engagement Consultant | Open Banking Europe</span></b><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;text-align:justify;background:white;background-attachment:scroll;background-position-x:0%;background-position-y:0%">
<span lang="DE" style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#222222"><a href="mailto:j.parracho@openbankingeurope.eu" target="_blank"><span style="color:#0563C1">j.parracho@openbankingeurope.eu</span></a></span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;text-align:justify;background:white;background-attachment:scroll;background-position-x:0%;background-position-y:0%">
<span lang="DE" style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#222222"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="DE" style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#222222"><img border="0" width="170" height="68" style="width:1.7656in;height:.7031in" id="gmail-m_-2939531249342851544Picture_x0020_2" src="cid:image001.png@01D690C4.3E6A1E20" alt="A close up of a logo
Description automatically generated"></span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="FR-BE" style="font-size:9.0pt;font-family:"Arial",sans-serif;color:#222222;background:white">40 rue de Courcelles | F-75008 Paris, France</span><span lang="DE" style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#222222;background:white"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;text-align:justify">
<span lang="EN-US" style="font-size:9.0pt;font-family:"Arial",sans-serif"><a href="https://www.openbankingeurope.eu/" target="_blank"><span style="color:#0563C1">https://www.openbankingeurope.eu/</span></a></span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;text-align:justify;background:white;background-attachment:scroll;background-position-x:0%;background-position-y:0%">
<span lang="DE" style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#222222"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;text-align:justify;background:white;background-attachment:scroll;background-position-x:0%;background-position-y:0%">
<span lang="DE" style="font-size:8.0pt;font-family:"Arial",sans-serif;color:gray">Open Banking Europe is owned by PRETA S.A.S. a wholly-owned subsidiary of ABE/EBA CLEARING S.A.S.</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;text-align:justify;background:white;background-attachment:scroll;background-position-x:0%;background-position-y:0%">
<span lang="DE" style="font-size:8.0pt;font-family:"Arial",sans-serif;color:gray">PRETA S.A.S. is registered with RCS PARIS under no. 798 483 053 | VAT no. FR 27 798 483 053</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;text-align:justify;background:white;background-attachment:scroll;background-position-x:0%;background-position-y:0%">
<span lang="DE" style="font-size:8.0pt;font-family:"Arial",sans-serif;color:gray">This message and any attachments (the "message") are confidential and intended solely for the addressees. Any unauthorized use or dissemination is prohibited. E-mails are susceptible
to alteration. PRETA shall not be liable for the message if altered, changed or falsified.</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;text-align:justify;background:white;background-attachment:scroll;background-position-x:0%;background-position-y:0%">
<span lang="FR" style="font-size:8.0pt;font-family:"Arial",sans-serif;color:gray">Ce message est confidentiel; son contenu ne représente en aucun cas un engagement de la part de </span><span lang="FR-BE" style="font-size:8.0pt;font-family:"Arial",sans-serif;color:gray">PRETA </span><span lang="FR" style="font-size:8.0pt;font-family:"Arial",sans-serif;color:gray">sous
réserve de tout accord conclu par écrit entre vous et </span><span lang="FR-BE" style="font-size:8.0pt;font-family:"Arial",sans-serif;color:gray">PRETA</span><span lang="FR" style="font-size:8.0pt;font-family:"Arial",sans-serif;color:gray">. Toute publication,
utilisation ou diffusion, même partielle, doit être autorisée préalablement.</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;text-align:justify;background:white;background-attachment:scroll;background-position-x:0%;background-position-y:0%">
<span lang="FR" style="font-size:8.0pt;font-family:"Arial",sans-serif;color:gray">Si vous n'êtes pas destinataire de ce message, merci d'en avertir immédiatement l'expéditeur.</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;text-align:justify;background:white;background-attachment:scroll;background-position-x:0%;background-position-y:0%">
<span lang="PT" style="font-size:8.0pt;font-family:"Arial",sans-serif;color:#222222"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-US" style="font-size:8.0pt;font-family:Webdings;color:#00B050">P</span><span lang="EN-US" style="font-size:8.0pt;font-family:"Arial",sans-serif;color:#00B050"> Please
consider the environment before printing this email</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
</div>
<p class="MsoNormal"><br>
<br>
Please consider the environment before printing this email.<br>
<br>
This email is from Open Banking Limited, Company Number 10440081. Our registered and postal address is 2 Thomas More Square, London, E1W 1YN. Any views or opinions are solely those of the author and do not necessarily represent those of Open Banking Limited.
<br>
<br>
This email and any attachments are confidential and are intended for the above named only. They may also be legally privileged or covered by other legal rights and rules. Unauthorised dissemination or copying of this email and any attachments, and any use or
disclosure of them, is strictly prohibited and may be illegal. If you have received them in error, please delete them and all copies from your system and notify the sender immediately by return email. You can also view our privacy policy (<a href="https://www.openbanking.org.uk/privacy-policy" target="_blank">https://www.openbanking.org.uk/privacy-policy</a>).
<o:p></o:p></p>
</div>
<p class="MsoNormal">_______________________________________________<br>
Openid-specs-fapi mailing list<br>
<a href="mailto:Openid-specs-fapi@lists.openid.net" target="_blank">Openid-specs-fapi@lists.openid.net</a><br>
<a href="http://lists.openid.net/mailman/listinfo/openid-specs-fapi" target="_blank">http://lists.openid.net/mailman/listinfo/openid-specs-fapi</a><o:p></o:p></p>
</blockquote>
</div>
</div>
<p class="MsoNormal"><br>
<b><i><span style="font-size:10.0pt;font-family:"Segoe UI",sans-serif;color:#555555;border:none windowtext 1.0pt;padding:0cm">CONFIDENTIALITY NOTICE: This email may contain confidential and privileged material for the sole use of the intended recipient(s).
Any review, use, distribution or disclosure by others is strictly prohibited. If you have received this communication in error, please notify the sender immediately by e-mail and delete the message and any file attachments from your computer. Thank you.</span></i></b><o:p></o:p></p>
</div>
<br>
<br>
Please consider the environment before printing this email.<br>
<br>
This email is from Open Banking Limited, Company Number 10440081. Our registered and postal address is 2 Thomas More Square, London, E1W 1YN. Any views or opinions are solely those of the author and do not necessarily represent those of Open Banking Limited.
<br>
<br>
This email and any attachments are confidential and are intended for the above named only. They may also be legally privileged or covered by other legal rights and rules. Unauthorised dissemination or copying of this email and any attachments, and any use or
disclosure of them, is strictly prohibited and may be illegal. If you have received them in error, please delete them and all copies from your system and notify the sender immediately by return email. You can also view our privacy policy (https://www.openbanking.org.uk/privacy-policy).
</body>
</html>