text about encryption algorithms in part2 may need clarification

[Joseph Heenan]

Part 2 currently states:

---

For JWE, both clients and authorization servers

1. shall not use the RSA1_5 algorithm.

---

https://www.iana.org/assignments/jose/jose.xhtml#web-signature-encryption-algorithms lists various encryption algorithms. I presume it’s probably implicit that you shouldn’t use an algorithm listed as prohibited there (e.g. A128CBC) but perhaps we should be more explicit? (Originally brought to my attention by Ray Voss in the FDX Security WG.)

I’m also not entirely clear that it’s in keeping to allow the use of symmetric keys (dir).

‌

[Nat Sakimura]

Sorry to say this but it is too late now. We need to get the spec out of the door. It should be put into errata.

[Nat Sakimura]

On hold after shipping 1.0

[Filip Skokan]

I’m also not entirely clear that it’s in keeping to allow the use of symmetric keys (dir).

@Joseph Heenan can you expand on this? dir is not the only symmetric algorithm. There are also A128GCMKW, A192GCMKW, A256GCMKW, A128KW, A192KW, A256KW, PBES2-HS256+A128KW, PBES2-HS384+A192KW, PBES2-HS512+A256KW which all use the client_secret when used in OIDC context.

[Joseph Heenan]

Thanks @Filip Skokan - my knowledge of JWE algs is limited, so not mentioning the A128GCMKW etc too was an accidental omission.

I’d view all of those as not matching the ethos of FAPI-RW which is careful to use asymmetric cryptography everywhere (meaning if another party is able to decrypt a message or otherwise impersonate a relying party it is essentially certain that the cause of poor private key handling by the relying party). Unfortunately I can’t find any phrases in FAPI-RW that outright say “don’t ever use symmetric keys”.