Core - (te) Add EC case back to 7.4. Self-Issued OpenID Provider Response

Final:

The sub (subject) Claim value is the base64url encoded SHA-256 hash of the concatenation of the octets of the UTF-8 representations of the base64url encoded key values in the sub_jwk Claim. When the kty value is RSA, the key values n and e are concatenated in that order. When the kty value is EC, the key values crv, x, and y are concatenated in that order.

Errata draft now:

The sub (subject) Claim value is the base64url encoded representation of the thumbprint of the key in the sub_jwk Claim. This thumbprint value is computed as the SHA-256 hash of the octets of the UTF-8 representation of a JWK constructed containing only the REQUIRED members to represent the key, with the member names sorted into lexicographic order, and with no white space or line breaks. For instance, when the kty value is RSA, the member names in the constructed JWK used in the thumbprint computation appear in the order e, kty, n. This thumbprint calculation is the same as that defined in the JWK Thumbprint [JWK.Thumbprint] specification.

It has dropped EC case. Pleases add it back.

Also, it is awkward to reference a private draft [JWK.Thumbprint] in the normative text portion. It is just informational, so it should either be dropped or put into the NOTE: at the end of this section.

Comments (1)