SECDIR review: Section 6 -- authentication and integrity need not be provided if the requestor encrypts the token?

[Nat Sakimura]

Section 6 describes how to validate a received JWT request token. Section 6.1 appears to not mandate use of a signature for an encrypted token, suggesting that authentication and integrity need not be provided if the requestor encrypts the token (and does not employ an authenticated encryption algorithm).

[Nat Sakimura]

The relevant sentence probably is:

The Authorization Server MUST decrypt the JWT in accordance with 
the JSON Web Encryption [RFC7516] specification.

Perhaps we might want to add a sentence or two.

[Nat Sakimura]

Some comments:

All JWE algorithms are integrity protecting. We also mandate JWS unless JWE uses symmetric key. It was clarified through Denis Pinkas (DP) comments, so I gather this is a Dup of the DP comment. Shall I close this as Dup?

[Nat Sakimura]

fixed #25

→ <<cset 94c7d498d4c7>>