Subject: [woes] FW: JSON Web Token (JWT) and JSON Web Signature (JWS) now in separate specs

From: Mike Jones <[email-masked]>
Date: Sun, 27 Mar 2011 09:10:07 +0000

Resending to WOES to make sure that it goes through, as I didn't receive my copy from the list.

From: Mike Jones
Sent: Friday, March 25, 2011 10:26 PM
To: [email-masked]; [email-masked]; [email-masked]
Cc: [email-masked]
Subject: JSON Web Token (JWT) and JSON Web Signature (JWS) now in separate specs

As promised, I have split the contents of the JWT spec draft-jones-json-web-token-01<http://self-issued.info/docs/draft-jones-json-web-token-01.html> into two simpler specs:
                draft-jones-json-web-token-02<http://self-issued.info/docs/draft-jones-json-web-token-02.html>
                draft-jones-json-web-signature-00<http://self-issued.info/docs/draft-jones-json-web-signature-00.html>
These should have introduced no semantic changes from the previous spec.

I then applied the feedback that I received since JWT -01 and created revised versions of the split specs:
                draft-jones-json-web-token-03<http://self-issued.info/docs/draft-jones-json-web-token-03.html>
                draft-jones-json-web-signature-01<http://self-issued.info/docs/draft-jones-json-web-signature-01.html>
The only breaking change introduced was that x5t (X.509 Certificate Thumbprint) is now a SHA-1 hash of the DER-encoded certificate, rather than a SHA-256 has, as SHA-1 is the prevailing existing practice for certificate thumbprint calculations.  See the Document History sections for details on each change made.

.txt and .xml versions are also available.  I plan to publish these as IETF drafts once the submission window re-opens on Monday.  Feedback welcome!

                                                            -- Mike

P.S.  Yes, work on the companion encryption spec is now under way...

---

From: Lucy Lynch <[email-masked]>
Date: Sun, 27 Mar 2011 02:40:58 -0700 (PDT)

> Resending to WOES to make sure that it goes through, as I didn't receive 

Thanks, and I got this the first time

> These should have introduced no semantic changes from the previous spec.

diff here:

http://tools.ietf.org/rfcdiff?url1=http://self-issued.info/docs/draft-jones-json-web-token-02.txt&url2=http://self-issued.info/docs/draft-jones-json-web-token-03.txt

> The only breaking change introduced was that x5t (X.509 Certificate Thumbprint) is now a SHA-1 hash of the DER-encoded certificate, rather than a SHA-256 has, as SHA-1 is the prevailing existing pr…

diff here:

http://tools.ietf.org/rfcdiff?url1=http://self-issued.info/docs/draft-jones-json-web-signature-00.txt&url2=http://self-issued.info/docs/draft-jones-json-web-signature-01.txt

> P.S.  Yes, work on the companion encryption spec is now under way...

_______________________________________________
woes mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/woes