This page (revision-1) was last changed on 29-Nov-2024 16:16 by UnknownAuthor

Only authorized users are allowed to rename pages.

Only authorized users are allowed to delete pages.

Page revision history

Version Date Modified Size Author Changes ... Change note

Page References

Incoming links Outgoing links
Proof-of-Possession Key Semantics for JSON Web Tokens (JWTs)
Proof-of-Possession Key Semantics for JSON Web Tokens (JWTs)

Version management

Difference between version and

At line 1 added 23 lines
!!! Overview
[{$pagename}] ([RFC 7800]) describes how a [JSON Web Token] ([JWT]) can declare that the presenter of the [JWT] possesses a particular [proof-of-Possession] ([PoP]) key and that the recipient can [cryptographically|cryptography] confirm [proof-of-Possession] of the key by the presenter.
[Proof-of-Possession] of a key is also sometimes described as the presenter being a holder-of-key.
The [OAuth 2.0 Proof-of-Possession (PoP) Security Architecture] specification describes key confirmation, among other confirmation mechanisms.
The [{$pagename}] specification defines how to communicate key confirmation key information in [JWTs].
The [Proof Key for Code Exchange by OAuth Public Clients] describes a [Proof-of-Possession] technique through the use of Proof Key for Code Exchange.
!! Representations for Proof-of-Possession Keys
By including a "[cnf]" (confirmation) [claim] in a JWT, the issuer of the [JWT] declares that the presenter possesses a particular key and that the recipient can cryptographically confirm that the presenter has possession of that key. The value of the "[cnf]" claim is a [JSON Object] and the members of that object identify the [Proof-of-Possession] key.
The presenter can be identified in one of several ways by the [JWT] depending upon the application requirements. If the [JWT] contains a "[sub]" (subject) claim [JWT], the presenter is normally the subject identified by the JWT. (In some applications, the subject identifier will be relative to the issuer identified by the "iss" ([issuer]) [claim] [JWT].)
If the [JWT] contains no "[sub]" claim, the presenter is normally the issuer identified by the JWT using the "iss" claim. The case in which the presenter is the subject of the [JWT] is analogous to [Security Assertion Markup Language] ([SAML]) 2.0 (OASIS.saml-core-2.0-os) SubjectConfirmation usage. At least one of the "[sub]" and "[iss]" claims MUST be present in the JWT. Some use cases may require that both be present.
Another means used by some applications to identify the presenter is an explicit claim, such as the "[azp]" ([Authorized party]) [claim] defined by [OpenID Connect] [OpenID.Core]. Ultimately, the means of identifying the presenter is application specific, as is the means of confirming possession of the key that is communicated.
!! More Information
There might be more information for this subject on one of the following:
[{ReferringPagesPlugin before='*' after='\n' }]
This page (revision-1) was last changed on 29-Nov-2024 16:16 by UnknownAuthorTop