The JSON-based Identity Protocol Suite

The JSON-based Identity Protocol Suite
By Travis Spencer

Copyright © 2013 Twobo Technologies AB.

Overview of the Protocol Suite

 JavaScript Object Notation (JSON) – Data
encoding format popularized by AJAX & REST
 All being defined in IETF
 Used to encode OAuth 2.0 security model
 Tokens (JWT) Encryption (JWE)
 Keys (JWK) Signatures (JWS)
 OAuth 2.0 Bearer Token spec binds it to OAuth
 Basis of OAuth and OpenID Connect


Overview of JWT

 JWT – pronounced “jot” – are lightweight tokens
passed in HTTP headers & query strings
 Three basic sections – header, claims, signature
 Akin to SAML tokens
 Less expressive
 Less security options
 Encoded w/ JSON not XML for compactness


Basic Layout & Wire Format

Header
Claims
Crypto
JWT Token
base64url(Header) + “.” + base64url(Claims) +
“.” + base64url(Crypto)

Claims Section

 Reserved (but optional) claim names
 Expiration time (exp) Issuer (iss)
 Not before (nbf) Type (typ)
 Issued at (iat) Audience (aud)
 Public claim names
 IANA JWT claims registry
 Domain name, OID, or UUID

 Private claim names – Any unused name
 Value can be any JSON type


Overview of JWE

 Used to encrypt JWTs
 Supports symmetric & asymmetric encryption
 Three basic sections – header, key, ciphertext
 Plaintext may be signed first
 Encryption algorithm
 RSA1_5 A(128|256)KW
 RSA-OAEP A(128|256)GCM
 ECDH-ES

 Cyphertext is put in the crypto section of the JWT



Header
Key
Ciphertext
JWE
JWE = base64url(Header) + “.” +
base64url(Key) + “.” + base64url(Ciphertext)

Overview of JWK

 Array of public keys encoded as JSON objects
 Intended for inclusion in JWS for signature
verification
 Explicit support for Elliptic Curve and RSA keys


JWK Example

{“keyvalues” : {“algorithm” : “RSA”,
[ “modulus” : “…”,
{“algorithm” : “EC”, “exponent” : “…”,
“curve” : “P-256”, “keyid” : “…”}
]
“x” : “…”,
}
“y” : “…”,
“use” : “encryption”,
“keyid” : “1”},

Overview of JWS

 Header input is JWT header
 Payload input is JWT claims
 Output is appended to JWT inputs & (optionally)
points to the JWK that was used
 Supports symmetric & asymmetric signing
algorithms
 HMAC SHA RSA SHA
 ECDSA w/ curve P & SHA



Header
Payload
JWS

JWS = base64url(sig(base64url(Header) + “.” +
base64url(Payload)))

Questions & Thanks

@2botech
@travisspencer
www.2botech.com
www.travisspencer.com

The JSON-based Identity Protocol Suite

The JSON-based Identity Protocol Suite

More Related Content

What's hot (7)

Viewers also liked (20)

Similar to The JSON-based Identity Protocol Suite (20)

Recently uploaded (20)

The JSON-based Identity Protocol Suite

Editor's Notes