The JSON-based Identity Protocol Suite

The JSON-based Identity Protocol SuiteBy Travis Spencer

Copyright © 2013 Twobo Technologies AB.

Overview of the Protocol Suite JavaScript Object Notation (JSON) – Data

encoding format popularized by AJAX & REST

All being defined in IETF

Used to encode OAuth 2.0 security model Tokens (JWT) ▪ Encryption (JWE) Keys (JWK) ▪ Signatures (JWS)

OAuth 2.0 Bearer Token spec binds it to OAuth

Basis of OAuth and OpenID Connect


Overview of JWT

JWT – pronounced “jot” – are lightweight tokens passed in HTTP headers & query strings

Three basic sections – header, claims, signature

Akin to SAML tokens Less expressive Less security options Encoded w/ JSON not XML for compactness


JWT Token

Basic Layout & Wire Format

Header

Claims

Crypto

base64url(Header) + “.” + base64url(Claims) + “.” +

base64url(Crypto)


Claims Section

Reserved (but optional) claim names Expiration time (exp) ▪ Issuer (iss) Not before (nbf) ▪ Type (typ) Issued at (iat) ▪ Audience (aud)

Public claim names IANA JWT claims registry Domain name, OID, or UUID

Private claim names – Any unused name

Value can be any JSON type


Overview of JWE

Used to encrypt JWTs

Supports symmetric & asymmetric encryption

Three basic sections – header, key, ciphertext

Plaintext may be signed first

Encryption algorithm RSA1_5 ▪ A(128|256)KW RSA-OAEP ▪ A(128|256)GCM ECDH-ES

Cyphertext is put in the crypto section of the JWT


JWE


Header

Key

Ciphertext

JWE = base64url(Header) + “.” + base64url(Key) + “.” + base64url(Ciphertext)


Overview of JWK

Array of public keys encoded as JSON objects

Intended for inclusion in JWS for signature verification

Explicit support for Elliptic Curve and RSA keys


JWK Example

{“keyvalues” :

[

{“algorithm” : “EC”,

“curve” : “P-256”,

“x” : “…”,

“y” : “…”,

“use” : “encryption”,

“keyid” : “1”},

{“algorithm” : “RSA”,

“modulus” : “…”,

“exponent” : “…”,

“keyid” : “…”}

]

}Copyright © 2013 Twobo Technologies AB.

Overview of JWS

Header input is JWT header

Payload input is JWT claims

Output is appended to JWT inputs & (optionally) points to the JWK that was used

Supports symmetric & asymmetric signing algorithms HMAC SHA ▪ RSA SHA ECDSA w/ curve P & SHA


Questions & Thanks

@2botech

@travisspencer

www.2botech.com

www.travisspencer.comCopyright © 2013 Twobo Technologies AB.

?

http://www.twitter.com/2botech

http://www.twitter.com/travisspencer

http://www.2botech.com/

http://www.travisspencer.com/

The JSON-based Identity Protocol Suite

Technology

Transcript of The JSON-based Identity Protocol Suite