Proof of Issuer Key Authority (PIKA)

Status of This Memo

This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.¶

Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at https://datatracker.ietf.org/drafts/current/.¶

Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."¶

This Internet-Draft will expire on 11 October 2024.¶

Copyright Notice

Copyright (c) 2024 IETF Trust and the persons identified as the document authors. All rights reserved.¶

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Revised BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Revised BSD License.¶

Table of Contents

1. Introduction

A relying party verifying a JSON Web Token (JWT) [RFC7519] needs to verify that the public key used to verify the signature legitimately represents the issuer represented in the "iss" claim of the JWT.¶

Today, relying parties commonly use the iss claim to fetch a set of authorized signing keys over HTTPS, relying on the security of HTTPS to establish the authority of the downloaded keys for that issuer. For example, in OpenID Connect Discovery [OIDC-Discovery], the iss claim is used to form a URL from which issuer metadata is downloaded over HTTPS. The issuer's JWK set is linked via the jwks_uri field in the metadata. The SD-JWT-VC specification describes a similar HTTPS-based mechanism for discovering the valid keys for an issuer (see Section 5 of [I-D.ietf-oauth-sd-jwt-vc]).¶

These HTTPS-based authority mechanisms are "live", in the sense that they can only prove the authority of a key to someone who does an HTTPS transaction with the relevant server. The fact that the server needs to be reachable and responsive at the time the JWT is being validated is a serious limitation in some use cases, two examples of which are given below.¶

In this document, we define Proofs of Issuer Key Authority (PIKA), a format for a redistributable proof of authority for an issuer key. As in OIDC and SD-JWT-VC, we assume that issuers are identified by HTTPS URLs, or at least by domain names. A PIKA is then simply a JWT whose payload contains the issuer key in question, and whose header contains an X.509 certificate proving that the PIKA-signing key is authoritative for the issuer's domain name.¶

This design preserves the same trust model as in the HTTPS-based proof of authority; it just swaps the signature in the TLS handshake underlying HTTPS for an object signature. PIKAs are thus "redistributable" in the same sense that an intermediate certificate would be, so that they can be verified without the issuer being online and reachable.¶

We also define a simple syntax for referencing PIKAs keys in metadata documents such as OIDC Discovery metadata and SD-JWT-VC issuer metadata.¶

2. Conventions and Definitions

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here.¶

3. Proof of Issuer Key Authority Format

Because the requirements for PIKAs are similar to those for OpenID Federation [OIDC-Federation], we re-use the Federation Historical Keys Response format as a base format for PIKAs.¶

A PIKA is a JWT meeting the requirements of the Historical Keys Response format in [OIDC-Federation]. In particular, the JWT Claims in a PIKA MUST contain iss, iat, and keys claims. Each JWK in the JWK Set in the keys claim MUST contain kid and exp claims, and SHOULD contain an iat claim.¶

A PIKA MUST also satisfy the following additional requirements:¶

• The iss field in the JWT Claims MUST be formatted as an HTTPS URL or a domain name.¶

• The JOSE Header of the PIKA MUST contain an x5c field. The contents of this field MUST represent a certificate chain that authenticates the domain name in the iss field. The domain name MUST appear as a dNSName entry in the subjectAltName extension of the end-entity certificate.¶

• The alg field of the PIKA MUST represent an algorithm that is compatible with the subject public key of the certificate in the x5c parameter.¶

• The JWT Claims in a PIKA SHOULD contain an exp claim. If an exp claim is not present, then a relying party MUST behave as if the exp field were set to the notAfter time in the end-entity certificate in the x5c field.¶

Figure 2 shows the contents of the JWT header and JWT payload for an example PIKA, omitting the full certificate chain:¶

JWT Header:
{
  "alg": "ES256",
  "typ": "JWT",
  "x5c": ["MII..."]
}

JWT Payload:
{
  "iss": "https://server.example.com",
  "iat": 123972394272,
  "exp": 124003930272,
  "keys":
    [
      {
        "kty": "EC",
        "crv": "P-256",
        "alg": "ES256"
        "x": "qiGKLwXRJmJR_AOQpWOHXLX5uYIfzvPwDurWvmZBwvw",
        "y": "ip8nyuLpJ5NpriZzCVKiG0TteqPMkrzfNOUQ8YzeGdk"
        "kid": "2HnoFS3YnC9tjiCaivhWLVUJ3AxwGGz_98uRFaqMEEs",
        "iat": 123972394872,
        "exp": 123974395972
      },
      {
        "kty": "RSA",
        "n": "ng5jr...",
        "e": "AQAB",
        "kid": "8KnoFS3YnC9tjiCaivhWLVUJ3AxwGGz_98uRFaqMJJr",
        "iat": 123972394872,
        "exp": 123974394972
        "revoked": {
          "revoked_at": 123972495172,
          "reason": "keyCompromise",
          "reason_code": 1
        }
      }
    ]
}

JWT Signature:
// Signature over JWT Header and Claims, as defined in RFC 7519

A Verifier that receives such a PIKA validates it by taking the following steps:¶

1. If this PIKA was looked up using an iss value, verify that the value of the iss claim in the PIKA is identical to the one used to discover it.¶

2. Verify that the PIKA is currently valid, according to its iat and exp claims.¶

3. Verify that the certificate chain in the x5c field is currently valid from a trusted certificate authority (see [@!RFC5280][@!RFC6125]).¶

4. Verify that the end-entity certificate matches the iss field of the PIKA.¶

5. Verify the signature on the PIKA using the subject public key of the end-entity certificate¶

Before using a key in a PIKA to validate a JWT, a Verifier MUST verify that the time at which the JWT was signed (e.g., as expressed by its iat claim) is within the signing interval for the key. This interval is expressed by the iat and exp fields within the key attested to in the PIKA.¶

4. Referencing Proofs of Issuer Key Authority

JWT issuers commonly advertise their JWK Sets using mechanisms such as OpenID Connect Discovery or SD-JWT-VC Credential Issuer Metadata [OIDC-Discovery] [I-D.ietf-oauth-sd-jwt-vc]. These discovery mechanisms could be extended to also provide PIKAs, using one of a few approaches.¶

Current discovery mechanisms typically present the issuer's JWK set as a value or link embedded in the metadata object. Similarly, the Federation Historical Keys endpoint in OpenID Federation provides a link from which the issuer's historical keys may be downloaded (see Section 5.1.1 of [OIDC-Federation]). These mechanisms are illustrated in Figure 3.¶

{
    // Other metadata...

    // Current mechanisms for unsigned JWKS
    "jwks_uri": "https://example.com/jwks",
    "jwks": { "keys": [ ... ] },

    // OpenID Federation historical keys
    "federation_historical_keys_endpoint": "https://example.com/historical_keys",
}

A similar field could be defined to provide a single set of issuer keys expressed as a PIKA, either by reference or by value. Such a mechanism requires the issuer to list all of the keys that are currently valid in one PIKA, requiring a Relying Party to download the whole PIKA even if they are only interested in one key.¶

An alternative design would allow for more specific PIKAs, covering individual keys and referencing them by kid. With such a design, an issuer metadata object would contain a map like the following (showing three keys with kid values "us-east-2024-01", "us-west-2024-01", and "us-east-2024-04"):¶

{
  // Other metadata...

  "signed_jwks": {
    "us-east-2024-01": "https://example.com/signed_jwks/us-east-2024-01",
    "us-west-2024-01": "https://example.com/signed_jwks/us-east-2024-01",
    "us-east-2024-04": "https://example.com/signed_jwks/us-east-2024-01",
  }
}

5. Security Considerations

The main difference between establishing the authority of issuer keys via PIKA vs. via HTTPS is that where HTTPS is ephemeral, a PIKA can be redistribted and verfied for some period of time (until its exp time). Issuers should exercise care in choosing the exp value they populate in a PIKA, in order to avoid a key being used beyond its intended lifetime.¶

An issuer may wish to revoke a key, in the sense of instructing verifiers that they should no longer use the key to validate JWTs from the issuer. PIKAs provide both implicit and explicit revocation. With implicit revocation, the issuer simply removes the key from PIKAs it publishes. With explicit revocation, the issuer adds a revoked field to the key, as described in [OIDC-Federation]. In either case, the key will no longer be used by verifiers once all PIKAs positively authorizing the key have expired.¶

The above properties imply an operational trade-off for issuers. On the one hand, having shorter PIKA validity times means that the issuer can revoke keys more quickly. On the other hand, having short PIKA validity times will require PIKAs to be signed more often, and result in higher load on endpoints by which PIKAs are distributed.¶

Acknowledgments

TODO acknowledge.¶

Authors' Addresses