Subject: [OAUTH-WG] JWT Secured Authorization Request (JAR): signing

From: George Aristy <[email-masked]>
Date: Tue, 14 Jan 2020 16:29:39 -0500

Hello everyone.

Is it possible to relax the requirement to sign the claims set if an
authenticated encryption mode with prior shared secrets is used? Eg.
https://tools.ietf.org/html/draft-madden-jose-ecdh-1pu-02. This would
reduce the size of the request object substantially.

Regards,
George Aristy

---

From: Benjamin Kaduk <[email-masked]>
Date: Wed, 15 Jan 2020 12:32:45 -0800

> reduce the size of the request object substantially.

It seems fairly late in the publication process to make such a change,
since the properties provided by digital signature and AEAD tag are subtly
different, and the key-management lifecycle needed to provide secure
operation is different.

That said, off the top of my head, I don't know of anything that would
prevent this functionality from being specified as an extension to plain
JAR.

-Ben