[S2S] - Ratify Encryption/Client Origin Mechanism
Open
Nobody has claimed this yet.
server-to-server
- Dominant language
- No language data
- Stars
- 125
- Forks
- 41
- PR merge metrics
- No merged PRs in 30d
Description
This is an issue tracking consensus on the mechanism for encryption in s2s. Current text proposes:
- Use JWE, mandating HPKE
- Use JWKs for keys, wrapped to provide attestations (using proofs) and purpose
- Use nested sign-then-encrypt JWTs for client origin, binding to jwk thumbprint
Still TODO: if we have any mandated supported curves and how to do post-quantum.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the current proposed S2S text described in this issue: JWE with HPKE, JWKs with attestations and purpose, and nested sign-then-encrypt JWTs for client origin. Determine the mandated supported curves and the post-quantum approach, then document the agreed encryption and origin mechanism once consensus is reached.
Written by the indexing model from the issue text.
Assessment
- Domain
- cryptography, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Quiet
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100