JWKS: Remove publicKeys in favor of RFC7515.

[mickenordin]

Fixes: #313

[glpatcern]

This is already good, do you think we could provide an example of how to use the jwks.json? Also, at this point I'm ok to keep the deprecated part, but I'd remove the now-fully-outdated example.

[mickenordin]

This is already good, do you think we could provide an example of how to use the jwks.json? Also, at this point I'm ok to keep the deprecated part, but I'd remove the now-fully-outdated example.

I removed the deprecated example now. Where would be a good place to put an example, and how would you like it to be? An example json with the various fields?

[glpatcern]

I removed the deprecated example now. Where would be a good place to put an example, and how would you like it to be? An example json with the various fields?

Good question: what about an Appendix as it was done with the previous example? Then yes I'd include an example JSON like the one in #313, and a code snippet from your own toy implementation (it's python IIRC right?) to 1) encode and add a signature at the sender and 2) validate it at the receiver.

[mickenordin]

I removed the deprecated example now. Where would be a good place to put an example, and how would you like it to be? An example json with the various fields?

Good question: what about an Appendix as it was done with the previous example? Then yes I'd include an example JSON like the one in #313, and a code snippet from your own toy implementation (it's python IIRC right?) to 1) encode and add a signature at the sender and 2) validate it at the receiver.

Good thing you mentioned appendices.. We hade appendix b with draft-cavage signature examples. I rewrote that, and I hope it is something what you wanted. A lot of python code didn't look good so a step by step algorithm turned out better I think.

[glpatcern]

Good thing you mentioned appendices.. We hade appendix b with draft-cavage signature examples. I rewrote that, and I hope it is something what you wanted. A lot of python code didn't look good so a step by step algorithm turned out better I think.

Ah yes, that appendix indeed was also obsoleted now, great that you rewrote it.

I think the text and the step by step part is good but the hackerprogrammer that is in me would still like to see some minimal code, let me give you an example.

[glpatcern]

So for the code snippets:

[mickenordin]

So for the code snippets:

There is e.g https://pypi.org/project/http-message-signatures/ but I am not sure that adding snippets using this is really helpful.

This is their example:

from http_message_signatures import HTTPMessageSigner, HTTPMessageVerifier, HTTPSignatureKeyResolver, algorithms, http_sfv
import requests, base64, hashlib

class MyHTTPSignatureKeyResolver(HTTPSignatureKeyResolver):
    keys = {"my-key": b"top-secret-key"}

    def resolve_public_key(self, key_id: str):
        return self.keys[key_id]

    def resolve_private_key(self, key_id: str):
        return self.keys[key_id]

request = requests.Request('POST', 'https://example.com/foo?param=Value&Pet=dog', json={"hello": "world"})
request = request.prepare()
request.headers["Content-Digest"] = str(http_sfv.Dictionary({"sha-256": hashlib.sha256(request.body).digest()}))

signer = HTTPMessageSigner(signature_algorithm=algorithms.HMAC_SHA256, key_resolver=MyHTTPSignatureKeyResolver())
signer.sign(request, key_id="my-key", covered_component_ids=("@method", "@authority", "@target-uri", "content-digest"))

verifier = HTTPMessageVerifier(signature_algorithm=algorithms.HMAC_SHA256, key_resolver=MyHTTPSignatureKeyResolver())
verifier.verify(request)

Easy enough to look up when implementing, but not really helping you understand what is going on IMO.

[glpatcern]

Easy enough to look up when implementing, but not really helping you understand what is going on IMO.

Well it's not too bad after all, but I take your point that it might be too much to include such code snippets in an Internet Draft. So let's give it try without and we can bring this to the WG anyway. Let me re-review for just a couple of fixes

[glpatcern]

Minimal fixes - I think it's better to have abstract values (as in RFC7515 actually), especially without any actual code snippet

[mickenordin]

Minimal fixes - I think it's better to have abstract values (as in RFC7515 actually), especially without any actual code snippet

Added in them now.