Subject: Re: [jose] JWT header "typ" parameter

From: "Vladimir Dzhuvinov / NimbusDS" <[email-masked]>
Date: Tue, 20 Mar 2012 10:13:59 -0700

Thanks John.

Is the JWT spec actually considered part of the JOSE spec group?

Vladimir

--
Vladimir Dzhuvinov : www.NimbusDS.com : [email-masked]

-------- Original Message --------
Subject: Re: [jose] JWT header "typ" parameter
From: John Bradley <[email-masked]>
Date: Tue, March 20, 2012 3:29 pm
To: "Vladimir Dzhuvinov / NimbusDS" <[email-masked]>
Cc: [email-masked]

The value of typ is JWS if the content is a JWS and likewise JWE if the
content is a JWE.

The value of typ is JWT to indicate the content is a a JSON object
expressing JWT semantics. 
The content could be a SAML assertion or anything else. Leading people
to extend typ

I think the new JOSE JWE & JWS drafts may help.
http://tools.ietf.org/html/draft-ietf-jose-json-web-signature
http://tools.ietf.org/html/draft-ietf-jose-json-web-encryption

So the short answer is that JWS and JWT can be used to secure any
content.
In many cases that content is a JWT security token.

The JWT spec is about the case where the content is a JWT so is less
generic than the 
JWS & JWE specs.

In hope that helps.
John B.

On 2012-03-20, at 8:45 AM, Vladimir Dzhuvinov / NimbusDS wrote:

> Hi guys,
> 
> I'm working on a JWT implementation for Java and I'm very pleased with
> this effort to standardise the messages.
> 
> http://tools.ietf.org/html/draft-jones-json-web-token-08#section-5 says
> that the "typ" declares the structure of the JWT and that if specified
> and the token is not nested, its value should be "JWT" or the equivalent
> URL.
> 
> My implementation approach has been to emphasise type safety and make
> use of enums where possible. "typ" seems like a candidate for enum, but
> I hesitate because of the RECOMMENDED tag. Why is the "typ":"JWT" value
> RECOMMENDED and not a MUST? Are there going to be situations when the
> JWT isn't actually going to be a JWT?
> 
> Cheers,
> 
> Vladimir
> 
> --
> Vladimir Dzhuvinov : www.NimbusDS.com : [email-masked]
> 
> _______________________________________________
> jose mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/jose

---

From: John Bradley <[email-masked]>
Date: Tue, 20 Mar 2012 14:21:16 -0300

Not at the moment.

There is a open question about it being more closely related to the OAuth WG.

JOSE is about signing and encryption,  so much like xmlenc and xmldsig are not part of SAML,
JWE and JWS may be better not irrevocably married to JWT.

That isn't to say that JWT might not eventually wind up in JOSE if there is demand from the WG.

I expect some of these discussions will happen next week in Paris.

John B.

---

From: Mike Jones <[email-masked]>
Date: Tue, 20 Mar 2012 17:54:34 +0000

Beyond what John wrote, I'll add that "typ" is optional in JWTs because in many contexts it's already known what the structure of the token is.  In those cases, there's no need to also include this information in the token itself.

				-- Mike

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of John Bradley
Sent: Tuesday, March 20, 2012 10:21 AM
To: Vladimir Dzhuvinov / NimbusDS
Cc: [email-masked]
Subject: Re: [jose] JWT header "typ" parameter

Not at the moment.

JOSE is about signing and encryption,  so much like xmlenc and xmldsig are not part of SAML, JWE and JWS may be better not irrevocably married to JWT.

John B.
On 2012-03-20, at 2:13 PM, Vladimir Dzhuvinov / NimbusDS wrote:

> The value of typ is JWS if the content is a JWS and likewise JWE if 
> the content is a JWE.
> 
> generic than the JWS & JWE specs.
> 
> In hope that helps.
> John B.
> 
> 
> 
>> I'm working on a JWT implementation for Java and I'm very pleased 
>> with this effort to standardise the messages.
>> 
>> http://tools.ietf.org/html/draft-jones-json-web-token-08#section-5 
>> says that the "typ" declares the structure of the JWT and that if 
>> specified and the token is not nested, its value should be "JWT" or 
>> the equivalent URL.
>> 
>> use of enums where possible. "typ" seems like a candidate for enum, 
>> but I hesitate because of the RECOMMENDED tag. Why is the "typ":"JWT" 
>> value RECOMMENDED and not a MUST? Are there going to be situations 
>> when the JWT isn't actually going to be a JWT?
>> 
>> Cheers,
>> 
>> Vladimir
>> 
>> --