openid / openid/OpenID4VP

Does the absent-`use` default apply to a mixed key set?

Open
#773 4 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Shell
Stars
112
Forks
38
Avg merge
12d 19h
Merged PRs (30d)
4

Description

The jwks definition contemplates a set serving more than one purpose. It describes the keys as those used as "an input to a key agreement that may be used for encryption of the Authorization Response", "or where the Wallet will require the public key of the Verifier to generate a Verifiable Presentation".

The same definition then states a default and advises labelling:

JWKs in this set that do not contain a use parameter are intended to be used for encryption of the Authorization Response.

If the Verifier includes keys intended for different purposes, it SHOULD set the use parameter in each key of the set to avoid ambiguity about which key to use for which purpose.

Read together on a set of the kind the first sentence describes, an unlabelled key that a Wallet needs for the second purpose is nonetheless defined as being for encryption of the response. That is not an ambiguity a Wallet can detect and work around, because the text supplies an answer rather than withholding one, and the answer is wrong for that key.

Labelling is advisory, so a Verifier that omits it has not violated anything. Section 8.3 restates the same default rather than narrowing it: "JWKs whose use parameter is absent or has the value enc are for encryption of the Authorization Response."

Each key does carry an identifier, since "Each JWK in the set MUST have a kid (Key ID) parameter that uniquely identifies the key within the context of the request", so the keys are individually addressable. What is not stated is which purpose each one serves.

I am not asking to revisit #642, where mandating use was considered and declined, and where this default was introduced as the alternative. The question is narrower: does that default apply to a set that also contains keys for the other purpose named in the same sentence? If it does not, saying so would resolve this. If it does, what is a Wallet expected to do with a key the default has assigned the wrong purpose?

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Read the jwks definition and Section 8.3, then compare their treatment of absent and explicit use values for mixed-purpose key sets. Review issue #642 for the decision history. Done means resolving whether the default applies to every unlabelled key in a mixed set and recording the expected Wallet behavior or a clarifying specification change.

Written by the indexing model from the issue text.

Assessment

Domain
cryptography, documentation
Issue type
Documentation
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.