Subject: [jose] FW: JSON Web Token (JWT) Specification Draft -08

From: Mike Jones <[email-masked]>
Date: Tue, 13 Mar 2012 01:07:32 +0000

From: Mike Jones
Sent: Monday, March 12, 2012 6:07 PM
To: [email-masked]
Subject: JSON Web Token (JWT) Specification Draft -08

Draft 08 of the JSON Web Token (JWT) specification<http://tools.ietf.org/html/draft-jones-json-web-token-08> has been published.  It uses the -01 versions of the JOSE specifications<http://self-issued.info/?p=688> and also contains these changes:

*         Removed language that required that a JWT must have three parts.  Now the number of parts is explicitly dependent upon the representation of the underlying JWS or JWE.

*         Moved the "alg":"none" definition to the JWS spec.

*         Registered the application/jwt MIME Media Type.

*         Clarified that the order of the creation and validation steps is not significant in cases where there are no dependencies between the inputs and outputs of the steps.

*         Corrected the Magic Signatures and Simple Web Token (SWT) references.

This specification is available at:

*         http://tools.ietf.org/html/draft-jones-json-web-token-08

An HTML formatted version is available at:

*         http://self-issued.info/docs/draft-jones-json-web-token-08.html

                                                                -- Mike

---

From: Thomas Hardjono <[email-masked]>
Date: Tue, 13 Mar 2012 16:36:25 +0000

Mike,

Just a minor nit/clarification:  what does "nested signing" and "nested encryption" mean in this draft? (versus ordinary signing and encryption).

Does it mean signing/encryption of some Claims inside the JWT (as separately from signing/encryption the entire JWT)?

Thanks.

/thomas/

__________________________________________

From: [email-masked] [mailto:[email-masked]] On Behalf Of Mike Jones
Sent: Monday, March 12, 2012 9:08 PM
To: [email-masked]
Subject: [jose] FW: JSON Web Token (JWT) Specification Draft -08

From: Mike Jones

                                                                -- Mike

---

From: John Bradley <[email-masked]>
Date: Tue, 13 Mar 2012 12:43:41 -0400

Encrypting a signed token or encrypting a signed one.  This is intend to be over whole objects.  The JWT spec allows the more complicated composition. 

Sent from my iPhone

On 2012-03-13, at 12:36 PM, Thomas Hardjono <[email-masked]> wrote:

> Mike,
>  
> Just a minor nit/clarification:  what does “nested signing” and “nested encryption” mean in this draft? (versus ordinary signing and encryption).
>  
> Draft 08 of the JSON Web Token (JWT) specification has been published.  It uses the -01 versions of the JOSE specifications and also contains these changes:
> ·         Removed language that required that a JWT must have three parts.  Now the number of parts is explicitly dependent upon the representation of the underlying JWS or JWE.
> ·         Moved the “alg”:“none” definition to the JWS spec.
> ·         Registered the application/jwt MIME Media Type.
> ·         Clarified that the order of the creation and validation steps is not significant in cases where there are no dependencies between the inputs and outputs of the steps.
> ·         Corrected the Magic Signatures and Simple Web Token (SWT) references.
>  
> ·         http://tools.ietf.org/html/draft-jones-json-web-token-08
>  
> ·         http://self-issued.info/docs/draft-jones-json-web-token-08.html
>  
>                                                                 -- Mike
>  
> _______________________________________________
> jose mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/jose

---

From: Thomas Hardjono <[email-masked]>
Date: Tue, 13 Mar 2012 20:01:06 +0000

Thanks.  Does it mean JWT supports (allows for) multi-level nesting.  If so, does it mean that as a verifier I would need to upwrap (decrypt) continuously until I see the “alg” flag?

/thomas/

From: John Bradley [mailto:[email-masked]]
Sent: Tuesday, March 13, 2012 12:44 PM
To: Thomas Hardjono
Cc: [email-masked]
Subject: Re: [jose] JSON Web Token (JWT) Specification Draft -08

Sent from my iPhone

On 2012-03-13, at 12:36 PM, Thomas Hardjono <[email-masked]<mailto:[email-masked]>> wrote:
Mike,

Thanks.

/thomas/

From: [email-masked]<mailto:[email-masked]> [mailto:[email-masked]]<mailto:[mailto:[email-masked]]> On Behalf Of Mike Jones
Sent: Monday, March 12, 2012 9:08 PM
To: [email-masked]<mailto:[email-masked]>
Subject: [jose] FW: JSON Web Token (JWT) Specification Draft -08

From: Mike Jones
Sent: Monday, March 12, 2012 6:07 PM
To: [email-masked]<mailto:[email-masked]>
Subject: JSON Web Token (JWT) Specification Draft -08

                                                                -- Mike

_______________________________________________
jose mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/jose

---

From: Mike Jones <[email-masked]>
Date: Tue, 13 Mar 2012 20:08:32 +0000

Yes, you have to keep validating through the nesting levels.  (Although the termination condition as written uses the “typ” value, since there will be an “alg” value for all levels of nested signing/encryption.  See Step 8 of the validation rules in http://tools.ietf.org/html/draft-jones-json-web-token-08#section-7.)

                                                            -- Mike

From: [email-masked] [mailto:[email-masked]] On Behalf Of Thomas Hardjono
Sent: Tuesday, March 13, 2012 1:01 PM
To: John Bradley
Cc: [email-masked]
Subject: Re: [jose] JSON Web Token (JWT) Specification Draft -08

/thomas/

From: John Bradley [mailto:[email-masked]]<mailto:[mailto:[email-masked]]>
Sent: Tuesday, March 13, 2012 12:44 PM
To: Thomas Hardjono
Cc: [email-masked]<mailto:[email-masked]>
Subject: Re: [jose] JSON Web Token (JWT) Specification Draft -08

Sent from my iPhone

Thanks.

/thomas/

From: Mike Jones

                                                                -- Mike

---

From: John Bradley <[email-masked]>
Date: Tue, 13 Mar 2012 17:56:06 -0400

Yes.  

You can also pass a JWS or JWE as the value of a JWT claim. 

John B. 

Sent from my iPhone