Does the absent-`use` default apply to a mixed key set?
Nobody has claimed this yet.
- Dominant language
- Shell
- Stars
- 112
- Forks
- 38
- Avg merge
- 12d 19h
- Merged PRs (30d)
- 4
Description
The jwks definition contemplates a set serving more than one purpose. It describes the keys as those used as "an input to a key agreement that may be used for encryption of the Authorization Response", "or where the Wallet will require the public key of the Verifier to generate a Verifiable Presentation".
The same definition then states a default and advises labelling:
JWKs in this set that do not contain a use parameter are intended to be used for encryption of the Authorization Response.
If the Verifier includes keys intended for different purposes, it SHOULD set the use parameter in each key of the set to avoid ambiguity about which key to use for which purpose.
Read together on a set of the kind the first sentence describes, an unlabelled key that a Wallet needs for the second purpose is nonetheless defined as being for encryption of the response. That is not an ambiguity a Wallet can detect and work around, because the text supplies an answer rather than withholding one, and the answer is wrong for that key.
Labelling is advisory, so a Verifier that omits it has not violated anything. Section 8.3 restates the same default rather than narrowing it: "JWKs whose use parameter is absent or has the value enc are for encryption of the Authorization Response."
Each key does carry an identifier, since "Each JWK in the set MUST have a kid (Key ID) parameter that uniquely identifies the key within the context of the request", so the keys are individually addressable. What is not stated is which purpose each one serves.
I am not asking to revisit #642, where mandating use was considered and declined, and where this default was introduced as the alternative. The question is narrower: does that default apply to a set that also contains keys for the other purpose named in the same sentence? If it does not, saying so would resolve this. If it does, what is a Wallet expected to do with a key the default has assigned the wrong purpose?
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Read the jwks definition and Section 8.3, then compare their treatment of absent and explicit use values for mixed-purpose key sets. Review issue #642 for the decision history. Done means resolving whether the default applies to every unlabelled key in a mixed set and recording the expected Wallet behavior or a clarifying specification change.
Written by the indexing model from the issue text.
Assessment
- Domain
- cryptography, documentation
- Issue type
- Documentation
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100