use Public Claim Names for CIBA JWT claims

[Brian Campbell]

Related to Issue #86 CIBA needs IANA Considerations, there are two new JWT claims in 10.3.1. Successful Token Delivery - rt_hash and auth_req_id.

New claims used in a specification really should be registered or use a collision-resistant name a.k.a. a Public Claim Name as discussed at https://tools.ietf.org/html/rfc7519#section-4.2

Based on the advice to the Designated Experts about claims registration https://tools.ietf.org/html/rfc7519#section-10.1 and what I know about how that advice has been interpreted, I suspect there would be some push-back on the registration requests for rt_hash as it's written now and for auth_req_id in general.

Given that in CIBA the ID token is always passed in the HTTP message body, the size is not of particular concern. I'd propose using public collision resistant names for the non standard JWT claims used in CIBA. Perhaps urn:openid:params:jwt:claim:rt_hash and urn:openid:params:jwt:claim:auth_req_id.

[Brian Campbell]

issue #92 "update/fix ID Token examples in CIBA Authentication Results" should be considered with this too

[Brian Campbell]

Folks were onboard with this during the Oct 2 MODRNA call.

[Brian Campbell]

pull request #24 has changes addressing this and issue #92

[Dave Tonge]

Resolves with this PR: https://bitbucket.org/openid/mobile/pull-requests/24/ciba-public-claim-names-and-updated-id

[Brian Campbell]

Not sure what happened but the changes didn't seem to actually make it in. Pull request #24 says it was MERGED at 2a712c4 but there's no actual changes in that commit.

[Brian Campbell]

merged pull request #36 to hopefully fix for real this time with, CIBA: use Public Claim Names for the auth_req_id and refresh token JWT claims for Issue #93 and also fix/update the two ID Token examples in the Authentication Results section for Issue #92