Subject: [jose] Attribute certificates

From: Luke Howard <[email-masked]>
Date: Mon, 9 Dec 2013 17:52:49 +1100

I've been prototyping JWT attribute certificates in Mozilla Persona [1] for use in gss_browserid [2] amongst other things.

Attribute certificates claim a subset of attributes about an identity and are intended to be selectively disclosable at presentation time in conjunction with a primary certificate. They are regular JWTs with the following reserved claims:

* A claim representing a binding to a primary certificate (currently, this is the "cb" claim containing the SHA-256 hash of the primary certificate JWT)

* A claim identifying the nature of the other claims made in the attribute certificate (currently, this is "id"). A user presenting a fresh attribute certificate with the same id meta-claim as a previous one should have confidence that it represents the same aspects of their identity

* A claim containing a human readable description of the attribute certificate

My current implementation requires that the attribute certificate issuer be the same as the primary certificate, but with a suitable trust model there's no reason attribute certificates from different issuers could not be supported. An attribute may have a shorter validity time than the primary certificate.

I'm wondering if there's any interest in documenting this, I think they may be useful irrespective of Persona. (There are a bunch things I need to clean up, such as conveying the certificate binding hash algorithm.)

cheers,
-- Luke

[1] https://groups.google.com/forum/#!topic/mozilla.dev.identity/kWhiJWH9AV0
[2] http://tools.ietf.org/html/draft-howard-gss-browserid-07