Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Expand nonce proteceted header definition; define CBOR data format #145

Merged
merged 1 commit into from
Oct 21, 2024
Merged

Expand nonce proteceted header definition; define CBOR data format #145

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 12 additions & 6 deletions draft-ietf-jose-json-web-proof.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -382,14 +382,20 @@ Use of this Header Parameter is OPTIONAL.

### "nonce" (Nonce) Header Parameter {#nonceDef}

> Editor's note: Need to resolve the difference between nonce in CBOR and JSON caused by EATS
The `nonce` (nonce) Header Parameter is used to associate protocol
state with a presented JWP. Usage is protocol-specific, but examples
include requiring a unique nonce in requests as part of a strategy to
prevent replay, or for associating a JWP back to the context where
it was requested.

The `nonce` (nonce) Header Parameter is a case-sensitive string value
used to associate protocol state with a JWP.
This can be used, for instance, to mitigate replay attacks.
The use of nonce values is generally protocol specific.
Its definition is intentionally parallel to the `nonce` claim
When used as a JSON Protected Header, the value is a case-sensitive
string value.

When used as a CBOR Protected Header, the value is a binary string.

This definition is intentionally parallel to the `nonce` claim
registered in the IANA "JSON Web Token Claims" registry (#IANA.JWT.Claims).

Use of this Header Parameter is OPTIONAL.

### "claims" (Claims) Header Parameter {#claimsDef}
Expand Down
Loading