Add encrypted JWPs #136
Add encrypted JWPs #136
Conversation
draft-ietf-jose-json-web-proof.md
Outdated
| A `cty` (content type) Header Parameter value of `jwp` is used to indicate | ||
| that the content of the JWE is a JWP using the JWP Compact Serialization. | ||
| A `cty` (content type) Header Parameter value of `jwp+json` is used to indicate | ||
| that the content of the JWE is the UTF-8 encoding of a JWP using the JWP JSON Serialization. | ||
| In both cases, the `cty` (content type) Header Parameter MUST be present | ||
| unless the application knows that the encrypted content is | ||
| a JWP by another means or convention, | ||
| in which case the `cty` value would typically be omitted. |
There was a problem hiding this comment.
These seem like they should be identical to the guidance in JWP around typ - if present, they SHOULD be the effective media type of the contained JWP. This MAY be in the JWP as the typ protected header parameter, or omitted from the JWP based on context.
There was a problem hiding this comment.
We would need to define two new "typ" values saying that the whole thing is an encrypted JWT using one or the other serializations if we were to go that route. But it would be better to use application-defined "typ" values using the +jwp suffix and/or application-defined "typ" values using the JSON Serialization.
Instead, the encryption treatment is intentionally exactly the same as for JWKs. Compare the language in this PR with that at https://www.rfc-editor.org/rfc/rfc7517.html#section-7 and let me know if there are changes you'd like to make it even more paralle.
There was a problem hiding this comment.
Oh wait - I get it now. Now that we have explicit typing, we should use the "typ" value of the enclosed JWP as the JWE "cty" value. I'll take a stab at that.
There was a problem hiding this comment.
@dwaite I updated the description to cater to explicit typing. Please re-review.
| @@ -657,7 +680,8 @@ This section registers the `+jwp` | |||
| structured syntax suffix [@RFC6838] | |||
| in the IANA "Structured Syntax Suffix" registry (#IANA.StructuredSuffix) | |||
| in the manner described in [@RFC6838], | |||
| which can be used to indicate that the media type is encoded as a JWP. | |||
| which can be used to indicate that the media type is encoded as a JWP | |||
| using the JWP Compact Serialization. | |||
Fixes #83
Cc @brentzundel