Subject: [OAUTH-WG] jwk as member for both asymmetric and symmetric in proof-of-possession-02

From: Brian Campbell <[email-masked]>
Date: Mon, 23 Mar 2015 01:41:23 -0500

Is there some reason that the "cnf" claim uses a member named "jwk" for
both the asymmetric case where its value is a JWK with a public key and the
symmetric case where its value is the JWE encrypted oct JWK (sections 3.1
<https://tools.ietf.org/html/draft-ietf-oauth-proof-of-possession-02#section-3.1>
and 3.2
<https://tools.ietf.org/html/draft-ietf-oauth-proof-of-possession-02#section-3.2>
)?

https://tools.ietf.org/html/draft-ietf-oauth-proof-of-possession-02#section-3.2
and

I realize that section 3.2 describes how to distinguish between the two
cases by the type of the member value. But it seems a bit awkward and I
kind of expected two different member names for the two different cases.

Maybe "ewk" or even just "jwe" for the encrypted key case?

Note that 3.2 also mentions the '"jwk" claim' which should probably say the
'"jwk" member". "cnf" is the claim and "jwk" is a member of that claim
value.