Subject: Re: [OAUTH-WG] proof-of-possession-02 unencrypted oct JWK in encrypted JWT okay?

From: Mike Jones <[email-masked]>
Date: Sat, 29 Aug 2015 01:04:52 +0000

This was added at the end of Section 3.2 in -04<http://tools.ietf.org/html/draft-ietf-oauth-proof-of-possession-04>.  Thanks again for the practical feedback, Brian!

                                                                -- Mike

From: John Bradley [mailto:[email-masked]]
Sent: Tuesday, August 11, 2015 4:05 PM
To: Mike Jones
Cc: Brian Campbell; oauth
Subject: Re: [OAUTH-WG] proof-of-possession-02 unencrypted oct JWK in encrypted JWT okay?

OK
On Aug 11, 2015, at 12:57 AM, Mike Jones <[email-masked]<mailto:[email-masked]>> wrote:

As discussed in the thread “[OAUTH-WG] JWT PoP Key Semantics WGLC followup 2 (was Re: proof-of-possession-02 unencrypted oct JWK in encrypted JWT okay?)”, I will update the draft to say that the symmetric key can be carried in the “jwk” element in an unencrypted form if the JWT is itself encrypted.  This will happen in -04.

                                                            -- Mike

From: OAuth [mailto:[email-masked]] On Behalf Of Brian Campbell
Sent: Sunday, March 22, 2015 11:41 PM
To: oauth
Subject: [OAUTH-WG] proof-of-possession-02 unencrypted oct JWK in encrypted JWT okay?

When the JWT is itself encrypted as a JWE, would it not be reasonable to have a symmetric key be represented in the cnf claim with the jwk member as an unencrypted JSON Web Key?
Is such a possibility left as an exercise to the reader? Or should it be more explicitly allowed or disallowed?

_______________________________________________
OAuth mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/oauth

---

From: Brian Campbell <[email-masked]>
Date: Mon, 31 Aug 2015 14:47:09 -0600

Thank you

On Fri, Aug 28, 2015 at 7:04 PM, Mike Jones <[email-masked]>
wrote:

> This was added at the end of Section 3.2 in -04
> <http://tools.ietf.org/html/draft-ietf-oauth-proof-of-possession-04>.
> Thanks again for the practical feedback, Brian!
>
>
>
>                                                                 -- Mike
>
>
>
> *From:* John Bradley [mailto:[email-masked]]
> *Sent:* Tuesday, August 11, 2015 4:05 PM
> *To:* Mike Jones
> *Cc:* Brian Campbell; oauth
> *Subject:* Re: [OAUTH-WG] proof-of-possession-02 unencrypted oct JWK in
> encrypted JWT okay?
>
>
>
> OK
>
> On Aug 11, 2015, at 12:57 AM, Mike Jones <[email-masked]>
> wrote:
>
>
>
> As discussed in the thread “[OAUTH-WG] JWT PoP Key Semantics WGLC followup
> 2 (was Re: proof-of-possession-02 unencrypted oct JWK in encrypted JWT
> okay?)”, I will update the draft to say that the symmetric key can be
> carried in the “jwk” element in an unencrypted form if the JWT is itself
> encrypted.  This will happen in -04.
>
>
>
>                                                             -- Mike
>
>
>
> *From:* OAuth [mailto:[email-masked] <[email-masked]>] *On
> Behalf Of *Brian Campbell
> *Sent:* Sunday, March 22, 2015 11:41 PM
> *To:* oauth
> *Subject:* [OAUTH-WG] proof-of-possession-02 unencrypted oct JWK in
> encrypted JWT okay?
>
>
>
> When the JWT is itself encrypted as a JWE, would it not be reasonable to
> have a symmetric key be represented in the cnf claim with the jwk member as
> an unencrypted JSON Web Key?
>
> [email-masked]

---

From: Mike Jones <[email-masked]>
Date: Mon, 31 Aug 2015 20:48:48 +0000

You’re welcome.  Thanks, as always, for the useful feedback that improved the specification.

From: Brian Campbell [mailto:[email-masked]]
Sent: Monday, August 31, 2015 1:47 PM
To: Mike Jones
Cc: oauth
Subject: Re: [OAUTH-WG] proof-of-possession-02 unencrypted oct JWK in encrypted JWT okay?

Thank you

On Fri, Aug 28, 2015 at 7:04 PM, Mike Jones <[email-masked]<mailto:[email-masked]>> wrote:
This was added at the end of Section 3.2 in -04<https://na01.safelinks.protection.outlook.com/?url=http%3a%2f%2ftools.ietf.org%2fhtml%2fdraft-ietf-oauth-proof-of-possession-04&data=01%7c01%7cMichael.Jones%40microsoft.com%7c8fc6894cabb2401f16d108d2b24568c4%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=ziYwMBX86u%2bC97p3VONieq8E%2bYNhXEEUVYcH2cn12nc%3d>.  Thanks again for the practical feedback, Brian!

                                                                -- Mike

From: John Bradley [mailto:[email-masked]<mailto:[email-masked]>]
Sent: Tuesday, August 11, 2015 4:05 PM
To: Mike Jones
Cc: Brian Campbell; oauth
Subject: Re: [OAUTH-WG] proof-of-possession-02 unencrypted oct JWK in encrypted JWT okay?

OK

                                                            -- Mike

_______________________________________________
OAuth mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/oauth<https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2fwww.ietf.org%2fmailman%2flistinfo%2foauth&data=01%7c01%7cMichael.Jones%40microsoft.com%7c8fc6894cabb2401f16d108d2b24568c4%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=ybBu1UvIY329rAf0U%2fF165BzKHKaXOqzGmf2B1FiZO4%3d>