< draft-ietf-jose-json-web-key-17.txt		draft-ietf-jose-json-web-key-18.txt >
	JOSE Working Group M. Jones		JOSE Working Group M. Jones
	Internet-Draft Microsoft		Internet-Draft Microsoft
	Intended status: Standards Track October 7, 2013		Intended status: Standards Track November 12, 2013
	Expires: April 10, 2014		Expires: May 16, 2014
	JSON Web Key (JWK)		JSON Web Key (JWK)
	draft-ietf-jose-json-web-key-17		draft-ietf-jose-json-web-key-18
	Abstract		Abstract
	A JSON Web Key (JWK) is a JavaScript Object Notation (JSON) data		A JSON Web Key (JWK) is a JavaScript Object Notation (JSON) data
	structure that represents a cryptographic key. This specification		structure that represents a cryptographic key. This specification
	also defines a JSON Web Key Set (JWK Set) JSON data structure for		also defines a JSON Web Key Set (JWK Set) JSON data structure for
	representing a set of JWKs. Cryptographic algorithms and identifiers		representing a set of JWKs. Cryptographic algorithms and identifiers
	for use with this specification are described in the separate JSON		for use with this specification are described in the separate JSON
	Web Algorithms (JWA) specification and IANA registries defined by		Web Algorithms (JWA) specification and IANA registries defined by
	that specification.		that specification.
	skipping to change at page 1, line 36 ¶		skipping to change at page 1, line 36 ¶
	Internet-Drafts are working documents of the Internet Engineering		Internet-Drafts are working documents of the Internet Engineering
	Task Force (IETF). Note that other groups may also distribute		Task Force (IETF). Note that other groups may also distribute
	working documents as Internet-Drafts. The list of current Internet-		working documents as Internet-Drafts. The list of current Internet-
	Drafts is at http://datatracker.ietf.org/drafts/current/.		Drafts is at http://datatracker.ietf.org/drafts/current/.
	Internet-Drafts are draft documents valid for a maximum of six months		Internet-Drafts are draft documents valid for a maximum of six months
	and may be updated, replaced, or obsoleted by other documents at any		and may be updated, replaced, or obsoleted by other documents at any
	time. It is inappropriate to use Internet-Drafts as reference		time. It is inappropriate to use Internet-Drafts as reference
	material or to cite them other than as "work in progress."		material or to cite them other than as "work in progress."
	This Internet-Draft will expire on April 10, 2014.		This Internet-Draft will expire on May 16, 2014.
	Copyright Notice		Copyright Notice
	Copyright (c) 2013 IETF Trust and the persons identified as the		Copyright (c) 2013 IETF Trust and the persons identified as the
	document authors. All rights reserved.		document authors. All rights reserved.
	This document is subject to BCP 78 and the IETF Trust's Legal		This document is subject to BCP 78 and the IETF Trust's Legal
	Provisions Relating to IETF Documents		Provisions Relating to IETF Documents
	(http://trustee.ietf.org/license-info) in effect on the date of		(http://trustee.ietf.org/license-info) in effect on the date of
	publication of this document. Please review these documents		publication of this document. Please review these documents
	skipping to change at page 2, line 17 ¶		skipping to change at page 2, line 17 ¶
	Table of Contents		Table of Contents
	1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 4		1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 4
	1.1. Notational Conventions . . . . . . . . . . . . . . . . . . 4		1.1. Notational Conventions . . . . . . . . . . . . . . . . . . 4
	2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 4		2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 4
	3. JSON Web Key (JWK) Format . . . . . . . . . . . . . . . . . . 5		3. JSON Web Key (JWK) Format . . . . . . . . . . . . . . . . . . 5
	3.1. "kty" (Key Type) Parameter . . . . . . . . . . . . . . . . 5		3.1. "kty" (Key Type) Parameter . . . . . . . . . . . . . . . . 5
	3.2. "use" (Key Use) Parameter . . . . . . . . . . . . . . . . 6		3.2. "use" (Key Use) Parameter . . . . . . . . . . . . . . . . 6
	3.3. "alg" (Algorithm) Parameter . . . . . . . . . . . . . . . 6		3.3. "alg" (Algorithm) Parameter . . . . . . . . . . . . . . . 6
	3.4. "kid" (Key ID) Parameter . . . . . . . . . . . . . . . . . 6		3.4. "kid" (Key ID) Parameter . . . . . . . . . . . . . . . . . 6
	3.5. "x5u" (X.509 URL) Parameter . . . . . . . . . . . . . . . 6		3.5. "x5u" (X.509 URL) Parameter . . . . . . . . . . . . . . . 7
	3.6. "x5t" (X.509 Certificate SHA-1 Thumbprint) Parameter . . . 7		3.6. "x5t" (X.509 Certificate SHA-1 Thumbprint) Parameter . . . 7
	3.7. "x5c" (X.509 Certificate Chain) Parameter . . . . . . . . 7		3.7. "x5c" (X.509 Certificate Chain) Parameter . . . . . . . . 8
	4. JSON Web Key Set (JWK Set) Format . . . . . . . . . . . . . . 7		4. JSON Web Key Set (JWK Set) Format . . . . . . . . . . . . . . 8
	4.1. "keys" Parameter . . . . . . . . . . . . . . . . . . . . . 8		4.1. "keys" Parameter . . . . . . . . . . . . . . . . . . . . . 9
	5. String Comparison Rules . . . . . . . . . . . . . . . . . . . 8		5. String Comparison Rules . . . . . . . . . . . . . . . . . . . 9
	6. Encrypted JWK and Encrypted JWK Set Formats . . . . . . . . . 8		6. Encrypted JWK and Encrypted JWK Set Formats . . . . . . . . . 9
	7. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 9		7. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 9
	7.1. JSON Web Key Parameters Registry . . . . . . . . . . . . . 9		7.1. JSON Web Key Parameters Registry . . . . . . . . . . . . . 10
	7.1.1. Registration Template . . . . . . . . . . . . . . . . 10		7.1.1. Registration Template . . . . . . . . . . . . . . . . 11
	7.1.2. Initial Registry Contents . . . . . . . . . . . . . . 10		7.1.2. Initial Registry Contents . . . . . . . . . . . . . . 11
	7.2. JSON Web Key Use Registry . . . . . . . . . . . . . . . . 11		7.2. JSON Web Key Use Registry . . . . . . . . . . . . . . . . 13
	7.2.1. Registration Template . . . . . . . . . . . . . . . . 12		7.2.1. Registration Template . . . . . . . . . . . . . . . . 13
	7.2.2. Initial Registry Contents . . . . . . . . . . . . . . 12		7.2.2. Initial Registry Contents . . . . . . . . . . . . . . 13
	7.3. JSON Web Key Set Parameters Registry . . . . . . . . . . . 12		7.3. JSON Web Key Set Parameters Registry . . . . . . . . . . . 14
	7.3.1. Registration Template . . . . . . . . . . . . . . . . 12		7.3.1. Registration Template . . . . . . . . . . . . . . . . 14
	7.3.2. Initial Registry Contents . . . . . . . . . . . . . . 13		7.3.2. Initial Registry Contents . . . . . . . . . . . . . . 14
	7.4. Media Type Registration . . . . . . . . . . . . . . . . . 13		7.4. Media Type Registration . . . . . . . . . . . . . . . . . 14
	7.4.1. Registry Contents . . . . . . . . . . . . . . . . . . 13		7.4.1. Registry Contents . . . . . . . . . . . . . . . . . . 14
	8. Security Considerations . . . . . . . . . . . . . . . . . . . 14		8. Security Considerations . . . . . . . . . . . . . . . . . . . 15
	9. References . . . . . . . . . . . . . . . . . . . . . . . . . . 15		9. References . . . . . . . . . . . . . . . . . . . . . . . . . . 16
	9.1. Normative References . . . . . . . . . . . . . . . . . . . 15		9.1. Normative References . . . . . . . . . . . . . . . . . . . 16
	9.2. Informative References . . . . . . . . . . . . . . . . . . 16		9.2. Informative References . . . . . . . . . . . . . . . . . . 18
	Appendix A. Example JSON Web Key Sets . . . . . . . . . . . . . . 17		Appendix A. Example JSON Web Key Sets . . . . . . . . . . . . . . 18
	A.1. Example Public Keys . . . . . . . . . . . . . . . . . . . 17		A.1. Example Public Keys . . . . . . . . . . . . . . . . . . . 18
	A.2. Example Private Keys . . . . . . . . . . . . . . . . . . . 17		A.2. Example Private Keys . . . . . . . . . . . . . . . . . . . 19
	A.3. Example Symmetric Keys . . . . . . . . . . . . . . . . . . 19		A.3. Example Symmetric Keys . . . . . . . . . . . . . . . . . . 21
	Appendix B. Example Use of "x5c" (X.509 Certificate Chain)		Appendix B. Example Use of "x5c" (X.509 Certificate Chain)
	Parameter . . . . . . . . . . . . . . . . . . . . . . 19		Parameter . . . . . . . . . . . . . . . . . . . . . . 21
	Appendix C. Example Encrypted RSA Private Key . . . . . . . . . . 20		Appendix C. Example Encrypted RSA Private Key . . . . . . . . . . 22
	C.1. Plaintext RSA Private Key . . . . . . . . . . . . . . . . 21		C.1. Plaintext RSA Private Key . . . . . . . . . . . . . . . . 23
	C.2. JWE Header . . . . . . . . . . . . . . . . . . . . . . . . 24		C.2. JWE Header . . . . . . . . . . . . . . . . . . . . . . . . 26
	C.3. Content Encryption Key (CEK) . . . . . . . . . . . . . . . 24		C.3. Content Encryption Key (CEK) . . . . . . . . . . . . . . . 26
	C.4. Key Encryption . . . . . . . . . . . . . . . . . . . . . . 25		C.4. Key Encryption . . . . . . . . . . . . . . . . . . . . . . 27
	C.5. Initialization Vector . . . . . . . . . . . . . . . . . . 25		C.5. Initialization Vector . . . . . . . . . . . . . . . . . . 27
	C.6. Additional Authenticated Data . . . . . . . . . . . . . . 25		C.6. Additional Authenticated Data . . . . . . . . . . . . . . 27
	C.7. Content Encryption . . . . . . . . . . . . . . . . . . . . 26		C.7. Content Encryption . . . . . . . . . . . . . . . . . . . . 28
	C.8. Complete Representation . . . . . . . . . . . . . . . . . 29		C.8. Complete Representation . . . . . . . . . . . . . . . . . 31
	Appendix D. Acknowledgements . . . . . . . . . . . . . . . . . . 30		Appendix D. Acknowledgements . . . . . . . . . . . . . . . . . . 32
	Appendix E. Document History . . . . . . . . . . . . . . . . . . 31		Appendix E. Document History . . . . . . . . . . . . . . . . . . 33
	Author's Address . . . . . . . . . . . . . . . . . . . . . . . . . 35		Author's Address . . . . . . . . . . . . . . . . . . . . . . . . . 37
	1. Introduction		1. Introduction
	A JSON Web Key (JWK) is a JavaScript Object Notation (JSON) [RFC4627]		A JSON Web Key (JWK) is a JavaScript Object Notation (JSON) [RFC4627]
	data structure that represents a cryptographic key. This		data structure that represents a cryptographic key. This
	specification also defines a JSON Web Key Set (JWK Set) JSON data		specification also defines a JSON Web Key Set (JWK Set) JSON data
	structure for representing a set of JWKs. Cryptographic algorithms		structure for representing a set of JWKs. Cryptographic algorithms
	and identifiers for use with this specification are described in the		and identifiers for use with this specification are described in the
	separate JSON Web Algorithms (JWA) [JWA] specification and IANA		separate JSON Web Algorithms (JWA) [JWA] specification and IANA
	registries defined by that specification.		registries defined by that specification.
	skipping to change at page 4, line 49 ¶		skipping to change at page 4, line 49 ¶
	ASCII(STRING) denotes the octets of the ASCII [USASCII]		ASCII(STRING) denotes the octets of the ASCII [USASCII]
	representation of STRING.		representation of STRING.
	The concatenation of two values A and B is denoted as A || B.		The concatenation of two values A and B is denoted as A || B.
	2. Terminology		2. Terminology
	These terms defined by the JSON Web Signature (JWS) [JWS]		These terms defined by the JSON Web Signature (JWS) [JWS]
	specification are incorporated into this specification: "Base64url		specification are incorporated into this specification: "Base64url
	Encoding" and "Collision Resistant Name".		Encoding" and "Collision-Resistant Name".
	These terms are defined for use by this specification:		These terms are defined for use by this specification:
	JSON Web Key (JWK) A JSON object that represents a cryptographic		JSON Web Key (JWK) A JSON object that represents a cryptographic
	key.		key.
	JSON Web Key Set (JWK Set) A JSON object that contains an array of		JSON Web Key Set (JWK Set) A JSON object that contains an array of
	JWKs as the value of its "keys" member.		JWKs as the value of its "keys" member.
	3. JSON Web Key (JWK) Format		3. JSON Web Key (JWK) Format
	A JSON Web Key (JWK) is a JSON object containing specific members, as		A JSON Web Key (JWK) is a JSON object. The members of the object
	specified below. Those members that are common to multiple key types		represent properties of the key, including its value. This document
	are defined below.		defines the key parameters that are not algorithm specific, and thus
			common to many keys.
	In addition to the common parameters, each JWK will have members that		In addition to the common parameters, each JWK will have members that
	are specific to the kind of key being represented. These members		are specific to the kind of key being represented. These members
	represent the parameters of the key. Section 5 of the JSON Web		represent the parameters of the key. Section 6 of the JSON Web
	Algorithms (JWA) [JWA] specification defines multiple kinds of		Algorithms (JWA) [JWA] specification defines multiple kinds of
	cryptographic keys and their associated members.		cryptographic keys and their associated members.
	The member names within a JWK MUST be unique; recipients MUST either		The member names within a JWK MUST be unique; recipients MUST either
	reject JWKs with duplicate member names or use a JSON parser that		reject JWKs with duplicate member names or use a JSON parser that
	returns only the lexically last duplicate member name, as specified		returns only the lexically last duplicate member name, as specified
	in Section 15.12 (The JSON Object) of ECMAScript 5.1 [ECMAScript].		in Section 15.12 (The JSON Object) of ECMAScript 5.1 [ECMAScript].
	Additional members MAY be present in the JWK. If not understood by		Additional members can be present in the JWK. If not understood by
	implementations encountering them, they MUST be ignored. Member		implementations encountering them, they MUST be ignored. Member
	names used for representing key parameters for different kinds of		names used for representing key parameters for different keys types
	keys need not be distinct. Any new member name SHOULD either be		need not be distinct. Any new member name should either be
	registered in the IANA JSON Web Key Parameters registry defined in		registered in the IANA JSON Web Key Parameters registry defined in
	Section 7.1 or be a value that contains a Collision Resistant Name.		Section 7.1 or be a value that contains a Collision-Resistant Name.
	3.1. "kty" (Key Type) Parameter		3.1. "kty" (Key Type) Parameter
	The "kty" (key type) member identifies the cryptographic algorithm		The "kty" (key type) member identifies the cryptographic algorithm
	family used with the key. "kty" values SHOULD either be registered in		family used with the key. "kty" values should either be registered in
	the IANA JSON Web Key Types registry defined in [JWA] or be a value		the IANA JSON Web Key Types registry defined in [JWA] or be a value
	that contains a Collision Resistant Name. The "kty" value is a case		that contains a Collision-Resistant Name. The "kty" value is a case-
	sensitive string. Use of this member is REQUIRED.		sensitive string. This member MUST be present in a JWK.
	A list of defined "kty" values can be found in the IANA JSON Web Key		A list of defined "kty" values can be found in the IANA JSON Web Key
	Types registry defined in [JWA]; the initial contents of this		Types registry defined in [JWA]; the initial contents of this
	registry are the values defined in Section 5.1 of the JSON Web		registry are the values defined in Section 6.1 of the JSON Web
	Algorithms (JWA) [JWA] specification.		Algorithms (JWA) [JWA] specification.
	Additional members used with these "kty" values can be found in the		The key type definitions include specification of the members to be
	IANA JSON Web Key Parameters registry defined in Section 7.1; the		used for those key types. Additional members used with "kty" values
	initial contents of this registry are the values defined in Sections		can also be found in the IANA JSON Web Key Parameters registry
	5.2 and 5.3 of the JSON Web Algorithms (JWA) [JWA] specification.		defined in Section 7.1.
	3.2. "use" (Key Use) Parameter		3.2. "use" (Key Use) Parameter
	The "use" (key use) member identifies the intended use of the key.		The "use" (key use) member identifies the intended use of the key.
	Values defined by this specification are:		Values defined by this specification are:
	o "sig" (signature or MAC operation)		o "sig" (signature or MAC)
	o "enc" (encryption)		o "enc" (encryption)
	Other values MAY be used. Key Use values can be registered in the		Other values MAY be used. Key Use values can be registered in the
	IANA JSON Web Key Use registry defined in Section 7.2. The "use"		IANA JSON Web Key Use registry defined in Section 7.2. The "use"
	value is a case sensitive string. A "use" member SHOULD be present,		value is a case-sensitive string. A "use" member SHOULD be present,
	unless the application uses another means or convention to determine		unless the application uses another means or convention to determine
	the intended key usage.		the intended key usage.
	When a key is used to wrap another key and a key use designation for		When a key is used to wrap another key and a key use designation for
	the first key is desired, the "enc" (encryption) key use value SHOULD		the first key is desired, the "enc" (encryption) key use value SHOULD
	be used, since key wrapping is a kind of encryption. (The "alg"		be used, since key wrapping is a kind of encryption. (The "alg"
	member can be used to specify the particular kind of encryption to be		member can be used to specify the particular kind of encryption to be
	performed, when desired.)		performed, when desired.)
	3.3. "alg" (Algorithm) Parameter		3.3. "alg" (Algorithm) Parameter
	The "alg" (algorithm) member identifies the algorithm intended for		The "alg" (algorithm) member identifies the algorithm intended for
	use with the key. The values used SHOULD either be registered in the		use with the key. The values used should either be registered in the
	IANA JSON Web Signature and Encryption Algorithms registry defined in		IANA JSON Web Signature and Encryption Algorithms registry defined in
	[JWA] or be a value that contains a Collision Resistant Name. Use of		[JWA] or be a value that contains a Collision-Resistant Name. Use of
	this member is OPTIONAL.		this member is OPTIONAL.
	3.4. "kid" (Key ID) Parameter		3.4. "kid" (Key ID) Parameter
	The "kid" (key ID) member can be used to match a specific key. This		The "kid" (key ID) member can be used to match a specific key. This
	can be used, for instance, to choose among a set of keys within a JWK		can be used, for instance, to choose among a set of keys within a JWK
	Set during key rollover. The interpretation of the "kid" value is		Set during key rollover. The structure of the "kid" value is
	unspecified. When "kid" values are used within a JWK Set, different		unspecified. When "kid" values are used within a JWK Set, different
	keys within the JWK Set SHOULD use distinct "kid" values. The "kid"		keys within the JWK Set SHOULD use distinct "kid" values. (One
	value is a case sensitive string. Use of this member is OPTIONAL.		example in which different keys might use the same "kid" value is if
			they have different "kty" (key type) values but are considered to be
			equivalent alternatives by the application using them.) The "kid"
			value is a case-sensitive string. Use of this member is OPTIONAL.
	When used with JWS or JWE, the "kid" value can be used to match a JWS		When used with JWS or JWE, the "kid" value is used to match a JWS or
	or JWE "kid" Header Parameter value.		JWE "kid" Header Parameter value.
	3.5. "x5u" (X.509 URL) Parameter		3.5. "x5u" (X.509 URL) Parameter
	The "x5u" (X.509 URL) member is a URI [RFC3986] that refers to a		The "x5u" (X.509 URL) member is a URI [RFC3986] that refers to a
	resource for an X.509 public key certificate or certificate chain		resource for an X.509 public key certificate or certificate chain
	[RFC5280]. The identified resource MUST provide a representation of		[RFC5280]. The identified resource MUST provide a representation of
	the certificate or certificate chain that conforms to RFC 5280		the certificate or certificate chain that conforms to RFC 5280
	[RFC5280] in PEM encoded form [RFC1421]. The key in the first		[RFC5280] in PEM encoded form [RFC1421]. The key in the first
	certificate MUST match the bare public key represented by other		certificate MUST match the public key represented by other members of
	members of the JWK. The protocol used to acquire the resource MUST		the JWK. The protocol used to acquire the resource MUST provide
	provide integrity protection; an HTTP GET request to retrieve the		integrity protection; an HTTP GET request to retrieve the certificate
	certificate MUST use TLS [RFC2818] [RFC5246]; the identity of the		MUST use TLS [RFC2818] [RFC5246]; the identity of the server MUST be
	server MUST be validated, as per Section 3.1 of HTTP Over TLS		validated, as per Section 3.1 of HTTP Over TLS [RFC2818]. Use of
	[RFC2818]. Use of this member is OPTIONAL.		this member is OPTIONAL.
			While there is no requirement that members other than those
			representing the public key be populated when an "x5u" member is
			present, doing so may improve interoperability for applications that
			do not handle PKIX certificates. If other members are present, the
			contents of those members MUST be semantically consistent with the
			related fields in the first certificate. For instance, if the "use"
			member is present, then it needs to allow for only a subset of the
			usages that are permitted by the certificate. Similarly, if the
			"alg" member is present, it should represent an algorithm that the
			certificate allows.
	3.6. "x5t" (X.509 Certificate SHA-1 Thumbprint) Parameter		3.6. "x5t" (X.509 Certificate SHA-1 Thumbprint) Parameter
	The "x5t" (X.509 Certificate SHA-1 Thumbprint) member is a base64url		The "x5t" (X.509 Certificate SHA-1 Thumbprint) member is a base64url
	encoded SHA-1 thumbprint (a.k.a. digest) of the DER encoding of an		encoded SHA-1 thumbprint (a.k.a. digest) of the DER encoding of an
	X.509 certificate [RFC5280]. The key in the certificate MUST match		X.509 certificate [RFC5280]. The key in the certificate MUST match
	the bare public key represented by other members of the JWK. Use of		the public key represented by other members of the JWK. Use of this
	this member is OPTIONAL.		member is OPTIONAL.
	If, in the future, certificate thumbprints need to be computed using		If, in the future, certificate thumbprints need to be computed using
	hash functions other than SHA-1, it is suggested that additional		hash functions other than SHA-1, it is suggested that additional
	related JWK parameters be defined for that purpose. For example, it		related JWK parameters be defined for that purpose. For example, it
	is suggested that a new "x5t#S256" (X.509 Certificate Thumbprint		is suggested that a new "x5t#S256" (X.509 Certificate Thumbprint
	using SHA-256) JWK parameter could be defined by registering it in		using SHA-256) JWK parameter could be defined by registering it in
	the IANA JSON Web Key Parameters registry defined in Section 7.1.		the IANA JSON Web Key Parameters registry defined in Section 7.1.
			As with the "x5u" member, members other than those representing the
			public key may also be populated when an "x5t" member is present. If
			other members are present, the contents of those members MUST be
			semantically consistent with the related fields in the referenced
			certificate. See the last paragraph of Section 3.5 for additional
			guidance on this.
	3.7. "x5c" (X.509 Certificate Chain) Parameter		3.7. "x5c" (X.509 Certificate Chain) Parameter
	The "x5c" (X.509 Certificate Chain) member contains a chain of one or		The "x5c" (X.509 Certificate Chain) member contains a chain of one or
	more PKIX certificates [RFC5280]. The certificate chain is		more PKIX certificates [RFC5280]. The certificate chain is
	represented as a JSON array of certificate value strings. Each		represented as a JSON array of certificate value strings. Each
	string in the array is a base64 encoded ([RFC4648] Section 4 -- not		string in the array is a base64 encoded ([RFC4648] Section 4 -- not
	base64url encoded) DER [ITU.X690.1994] PKIX certificate value. The		base64url encoded) DER [ITU.X690.1994] PKIX certificate value. The
	PKIX certificate containing the key value MUST be the first		PKIX certificate containing the key value MUST be the first
	certificate. This MAY be followed by additional certificates, with		certificate. This MAY be followed by additional certificates, with
	each subsequent certificate being the one used to certify the		each subsequent certificate being the one used to certify the
	previous one. The key in the first certificate MUST match the bare		previous one. The key in the first certificate MUST match the public
	public key represented by other members of the JWK. Use of this		key represented by other members of the JWK. Use of this member is
	member is OPTIONAL.		OPTIONAL.
			As with the "x5u" member, members other than those representing the
			public key may also be populated when an "x5c" member is present. If
			other members are present, the contents of those members MUST be
			semantically consistent with the related fields in the first
			certificate. See the last paragraph of Section 3.5 for additional
			guidance on this.
	4. JSON Web Key Set (JWK Set) Format		4. JSON Web Key Set (JWK Set) Format
	A JSON Web Key Set (JWK Set) is a JSON object that contains an array		A JSON Web Key Set (JWK Set) is a JSON object representing a set of
	of JWK values as the value of its "keys" member.		JWKs. The JSON object MUST have a "keys" member, which is an array
			of JWK objects.
	The member names within a JWK Set MUST be unique; recipients MUST		The member names within a JWK Set MUST be unique; recipients MUST
	either reject JWK Sets with duplicate member names or use a JSON		either reject JWK Sets with duplicate member names or use a JSON
	parser that returns only the lexically last duplicate member name, as		parser that returns only the lexically last duplicate member name, as
	specified in Section 15.12 (The JSON Object) of ECMAScript 5.1		specified in Section 15.12 (The JSON Object) of ECMAScript 5.1
	[ECMAScript].		[ECMAScript].
	Additional members MAY be present in the JWK Set. If not understood		Additional members can be present in the JWK Set. If not understood
	by implementations encountering them, they MUST be ignored.		by implementations encountering them, they MUST be ignored.
	Parameters for representing additional properties of JWK Sets SHOULD		Parameters for representing additional properties of JWK Sets should
	either be registered in the IANA JSON Web Key Set Parameters registry		either be registered in the IANA JSON Web Key Set Parameters registry
	defined in Section 7.3 or be a value that contains a Collision		defined in Section 7.3 or be a value that contains a Collision-
	Resistant Name.		Resistant Name.
	Implementations SHOULD ignore JWKs within a JWK Set that use "kty"		Implementations SHOULD ignore JWKs within a JWK Set that use "kty"
	(key type) values that are not understood by them.		(key type) values that are not understood by them, are missing
			required members, or for which values are out of the supported
			ranges.
	4.1. "keys" Parameter		4.1. "keys" Parameter
	The value of the "keys" member is an array of JWK values. By		The value of the "keys" member is an array of JWK values. By
	default, the order of the JWK values within the array does not imply		default, the order of the JWK values within the array does not imply
	an order of preference among them, although applications of JWK Sets		an order of preference among them, although applications of JWK Sets
	can choose to assign a meaning to the order for their purposes, if		can choose to assign a meaning to the order for their purposes, if
	desired. Use of this member is REQUIRED.		desired. This member MUST be present in a JWK Set.
	5. String Comparison Rules		5. String Comparison Rules
	The string comparison rules for this specification are the same as		The string comparison rules for this specification are the same as
	those defined in Section 5.3 of [JWS].		those defined in Section 5.3 of [JWS].
	6. Encrypted JWK and Encrypted JWK Set Formats		6. Encrypted JWK and Encrypted JWK Set Formats
	JWKs containing non-public key material will need to be encrypted in		JWKs containing non-public key material will need to be encrypted in
	some contexts to prevent the disclosure of private or symmetric key		some contexts to prevent the disclosure of private or symmetric key
	values to unintended parties. The use of an Encrypted JWK, which is		values to unintended parties. The use of an Encrypted JWK, which is
	a JWE with a JWK as its plaintext value, is RECOMMENED for this		a JWE with the UTF-8 encoding of a JWK as its plaintext value, is
	purpose. The processing of Encrypted JWKs is identical to the		recommended for this purpose. The processing of Encrypted JWKs is
	processing of other JWEs. A "cty" (content type) Header Parameter		identical to the processing of other JWEs. A "cty" (content type)
	value of "jwk+json" MUST be used to indicate that the content of the		Header Parameter value of "jwk+json" MUST be used to indicate that
	JWE is a JWK, unless the application knows that the encrypted content		the content of the JWE is a JWK, unless the application knows that
	is a JWK by another means or convention.		the encrypted content is a JWK by another means or convention.
	JWK Sets containing non-public key material will similarly need to be		JWK Sets containing non-public key material will similarly need to be
	encrypted. The use of an Encrypted JWK Set, which is a JWE with a		encrypted. The use of an Encrypted JWK Set, which is a JWE with the
	JWK Set as its plaintext value, is RECOMMENED for this purpose. The		UTF-8 encoding of a JWK Set as its plaintext value, is recommended
	processing of Encrypted JWK Sets is identical to the processing of		for this purpose. The processing of Encrypted JWK Sets is identical
	other JWEs. A "cty" (content type) Header Parameter value of		to the processing of other JWEs. A "cty" (content type) Header
	"jwk-set+json" MUST be used to indicate that the content of the JWE		Parameter value of "jwk-set+json" MUST be used to indicate that the
	is a JWK Set, unless the application knows that the encrypted content		content of the JWE is a JWK Set, unless the application knows that
	is a JWK Set by another means or convention.		the encrypted content is a JWK Set by another means or convention.
	See Appendix C for an example encrypted JWK.		See Appendix C for an example encrypted JWK.
	7. IANA Considerations		7. IANA Considerations
	The following registration procedure is used for all the registries		The following registration procedure is used for all the registries
	established by this specification.		established by this specification.
	Values are registered with a Specification Required [RFC5226] after a		Values are registered with a Specification Required [RFC5226] after a
	two-week review period on the [TBD]@ietf.org mailing list, on the		two-week review period on the [TBD]@ietf.org mailing list, on the
	skipping to change at page 10, line 21 ¶		skipping to change at page 11, line 12 ¶
	parameter name is disambiguated by the "kty" value of the JWK		parameter name is disambiguated by the "kty" value of the JWK
	containing it.		containing it.
	7.1.1. Registration Template		7.1.1. Registration Template
	Parameter Name:		Parameter Name:
	The name requested (e.g., "example"). Because a core goal of this		The name requested (e.g., "example"). Because a core goal of this
	specification is for the resulting representations to be compact,		specification is for the resulting representations to be compact,
	it is RECOMMENDED that the name be short -- not to exceed 8		it is RECOMMENDED that the name be short -- not to exceed 8
	characters without a compelling reason to do so. This name is		characters without a compelling reason to do so. This name is
	case sensitive. Names may not match other registered names in a		case-sensitive. Names may not match other registered names in a
	case insensitive manner unless the Designated Expert(s) state that		case-insensitive manner unless the Designated Expert(s) state that
	there is a compelling reason to allow an exception in this		there is a compelling reason to allow an exception in this
	particular case.		particular case. However, matching names may be registered,
			provided that the accompanying sets of "kty" values that the
			Parameter Name is used with are disjoint; for the purposes of
			matching "kty" values, "*" matches all values.
			Parameter Description:
			Brief description of the parameter (e.g., "Example description").
	Used with "kty" Value(s):		Used with "kty" Value(s):
	The key type parameter value(s) that the parameter name is to be		The key type parameter value(s) that the parameter name is to be
	used with, or the value "*" if the parameter value is used with		used with, or the value "*" if the parameter value is used with
	all key types.		all key types. Values may not match other registered "kty" values
			in a case-insensitive manner when the registered Parameter Name is
			the same (including when the Parameter Name matches in a case-
			insensitive manner) unless the Designated Expert(s) state that
			there is a compelling reason to allow an exception in this
			particular case.
	Parameter Information Class:		Parameter Information Class:
	Registers whether the parameter conveys public or private		Registers whether the parameter conveys public or private
	information. Its value must be one the words Public or Private.		information. Its value must be one the words Public or Private.
	Change Controller:		Change Controller:
	For Standards Track RFCs, state "IESG". For others, give the name		For Standards Track RFCs, state "IESG". For others, give the name
	of the responsible party. Other details (e.g., postal address,		of the responsible party. Other details (e.g., postal address,
	email address, home page URI) may also be included.		email address, home page URI) may also be included.
	Specification Document(s):		Specification Document(s):
	Reference to the document(s) that specify the parameter,		Reference to the document(s) that specify the parameter,
	preferably including URI(s) that can be used to retrieve copies of		preferably including URI(s) that can be used to retrieve copies of
	the document(s). An indication of the relevant sections may also		the document(s). An indication of the relevant sections may also
	be included but is not required.		be included but is not required.
	7.1.2. Initial Registry Contents		7.1.2. Initial Registry Contents
	o Parameter Name: "kty"		o Parameter Name: "kty"
			o Parameter Description: Key Type
	o Used with "kty" Value(s): *		o Used with "kty" Value(s): *
	o Parameter Information Class: Public		o Parameter Information Class: Public
	o Change Controller: IESG		o Change Controller: IESG
	o Specification Document(s): Section 3.1 of [[ this document ]]		o Specification Document(s): Section 3.1 of [[ this document ]]
	o Parameter Name: "use"		o Parameter Name: "use"
			o Parameter Description: Key Use
	o Used with "kty" Value(s): *		o Used with "kty" Value(s): *
	o Parameter Information Class: Public		o Parameter Information Class: Public
	o Change Controller: IESG		o Change Controller: IESG
	o Specification Document(s): Section 3.2 of [[ this document ]]		o Specification Document(s): Section 3.2 of [[ this document ]]
	o Parameter Name: "alg"		o Parameter Name: "alg"
			o Parameter Description: Algorithm
	o Used with "kty" Value(s): *		o Used with "kty" Value(s): *
	o Parameter Information Class: Public		o Parameter Information Class: Public
	o Change Controller: IESG		o Change Controller: IESG
	o Specification Document(s): Section 3.3 of [[ this document ]]		o Specification Document(s): Section 3.3 of [[ this document ]]
	o Parameter Name: "kid"		o Parameter Name: "kid"
			o Parameter Description: Key ID
	o Used with "kty" Value(s): *		o Used with "kty" Value(s): *
	o Parameter Information Class: Public		o Parameter Information Class: Public
	o Change Controller: IESG		o Change Controller: IESG
	o Specification Document(s): Section 3.4 of [[ this document ]]		o Specification Document(s): Section 3.4 of [[ this document ]]
	o Parameter Name: "x5u"		o Parameter Name: "x5u"
			o Parameter Description: X.509 URL
	o Used with "kty" Value(s): *		o Used with "kty" Value(s): *
	o Parameter Information Class: Public		o Parameter Information Class: Public
	o Change Controller: IESG		o Change Controller: IESG
	o Specification Document(s): Section 3.5 of [[ this document ]]		o Specification Document(s): Section 3.5 of [[ this document ]]
	o Parameter Name: "x5t"		o Parameter Name: "x5t"
			o Parameter Description: X.509 Certificate SHA-1 Thumbprint
	o Used with "kty" Value(s): *		o Used with "kty" Value(s): *
	o Parameter Information Class: Public		o Parameter Information Class: Public
	o Change Controller: IESG		o Change Controller: IESG
	o Specification Document(s): Section 3.6 of [[ this document ]]		o Specification Document(s): Section 3.6 of [[ this document ]]
	o Parameter Name: "x5c"		o Parameter Name: "x5c"
			o Parameter Description: X.509 Certificate Chain
	o Used with "kty" Value(s): *		o Used with "kty" Value(s): *
	o Parameter Information Class: Public		o Parameter Information Class: Public
	o Change Controller: IESG		o Change Controller: IESG
	o Specification Document(s): Section 3.7 of [[ this document ]]		o Specification Document(s): Section 3.7 of [[ this document ]]
	7.2. JSON Web Key Use Registry		7.2. JSON Web Key Use Registry
	This specification establishes the IANA JSON Web Key Use registry for		This specification establishes the IANA JSON Web Key Use registry for
	JWK "use" member values. The registry records the key use value and		JWK "use" member values. The registry records the key use value and
	a reference to the specification that defines it. This specification		a reference to the specification that defines it. This specification
	registers the parameter names defined in Section 3.2.		registers the parameter names defined in Section 3.2.
	7.2.1. Registration Template		7.2.1. Registration Template
	Use Member Value:		Use Member Value:
	The name requested (e.g., "example"). Because a core goal of this		The name requested (e.g., "example"). Because a core goal of this
	specification is for the resulting representations to be compact,		specification is for the resulting representations to be compact,
	it is RECOMMENDED that the name be short -- not to exceed 8		it is RECOMMENDED that the name be short -- not to exceed 8
	characters without a compelling reason to do so. This name is		characters without a compelling reason to do so. This name is
	case sensitive. Names may not match other registered names in a		case-sensitive. Names may not match other registered names in a
	case insensitive manner unless the Designated Expert(s) state that		case-insensitive manner unless the Designated Expert(s) state that
	there is a compelling reason to allow an exception in this		there is a compelling reason to allow an exception in this
	particular case.		particular case.
			Use Description:
			Brief description of the use (e.g., "Example description").
	Change Controller:		Change Controller:
	For Standards Track RFCs, state "IESG". For others, give the name		For Standards Track RFCs, state "IESG". For others, give the name
	of the responsible party. Other details (e.g., postal address,		of the responsible party. Other details (e.g., postal address,
	email address, home page URI) may also be included.		email address, home page URI) may also be included.
	Specification Document(s):		Specification Document(s):
	Reference to the document(s) that specify the parameter,		Reference to the document(s) that specify the parameter,
	preferably including URI(s) that can be used to retrieve copies of		preferably including URI(s) that can be used to retrieve copies of
	the document(s). An indication of the relevant sections may also		the document(s). An indication of the relevant sections may also
	be included but is not required.		be included but is not required.
	7.2.2. Initial Registry Contents		7.2.2. Initial Registry Contents
	o Use Member Value: "sig"		o Use Member Value: "sig"
			o Use Description: Signature or MAC
	o Change Controller: IESG		o Change Controller: IESG
	o Specification Document(s): Section 3.2 of [[ this document ]]		o Specification Document(s): Section 3.2 of [[ this document ]]
	o Use Member Value: "enc"		o Use Member Value: "enc"
			o Use Description: Encryption
	o Change Controller: IESG		o Change Controller: IESG
	o Specification Document(s): Section 3.2 of [[ this document ]]		o Specification Document(s): Section 3.2 of [[ this document ]]
	7.3. JSON Web Key Set Parameters Registry		7.3. JSON Web Key Set Parameters Registry
	This specification establishes the IANA JSON Web Key Set Parameters		This specification establishes the IANA JSON Web Key Set Parameters
	registry for JWK Set parameter names. The registry records the		registry for JWK Set parameter names. The registry records the
	parameter name and a reference to the specification that defines it.		parameter name and a reference to the specification that defines it.
	This specification registers the parameter names defined in		This specification registers the parameter names defined in
	Section 4.		Section 4.
	7.3.1. Registration Template		7.3.1. Registration Template
	Parameter Name:		Parameter Name:
	The name requested (e.g., "example"). Because a core goal of this		The name requested (e.g., "example"). Because a core goal of this
	specification is for the resulting representations to be compact,		specification is for the resulting representations to be compact,
	it is RECOMMENDED that the name be short -- not to exceed 8		it is RECOMMENDED that the name be short -- not to exceed 8
	characters without a compelling reason to do so. This name is		characters without a compelling reason to do so. This name is
	case sensitive. Names may not match other registered names in a		case-sensitive. Names may not match other registered names in a
	case insensitive manner unless the Designated Expert(s) state that		case-insensitive manner unless the Designated Expert(s) state that
	there is a compelling reason to allow an exception in this		there is a compelling reason to allow an exception in this
	particular case.		particular case.
			Parameter Description:
			Brief description of the parameter (e.g., "Example description").
	Change Controller:		Change Controller:
	For Standards Track RFCs, state "IESG". For others, give the name		For Standards Track RFCs, state "IESG". For others, give the name
	of the responsible party. Other details (e.g., postal address,		of the responsible party. Other details (e.g., postal address,
	email address, home page URI) may also be included.		email address, home page URI) may also be included.
	Specification Document(s):		Specification Document(s):
	Reference to the document(s) that specify the parameter,		Reference to the document(s) that specify the parameter,
	preferably including URI(s) that can be used to retrieve copies of		preferably including URI(s) that can be used to retrieve copies of
	the document(s). An indication of the relevant sections may also		the document(s). An indication of the relevant sections may also
	be included but is not required.		be included but is not required.
	7.3.2. Initial Registry Contents		7.3.2. Initial Registry Contents
	o Parameter Name: "keys"		o Parameter Name: "keys"
			o Parameter Description: Array of JWK values
	o Change Controller: IESG		o Change Controller: IESG
	o Specification Document(s): Section 4.1 of [[ this document ]]		o Specification Document(s): Section 4.1 of [[ this document ]]
	7.4. Media Type Registration		7.4. Media Type Registration
	7.4.1. Registry Contents		7.4.1. Registry Contents
	This specification registers the "application/jwk+json" and		This specification registers the "application/jwk+json" and
	"application/jwk-set+json" Media Types [RFC2046] in the MIME Media		"application/jwk-set+json" Media Types [RFC2046] in the MIME Media
	Types registry [IANA.MediaTypes], which can be used to indicate,		Types registry [IANA.MediaTypes], which can be used to indicate,
	skipping to change at page 14, line 41 ¶		skipping to change at page 16, line 11 ¶
	8. Security Considerations		8. Security Considerations
	All of the security issues faced by any cryptographic application		All of the security issues faced by any cryptographic application
	must be faced by a JWS/JWE/JWK agent. Among these issues are		must be faced by a JWS/JWE/JWK agent. Among these issues are
	protecting the user's private and symmetric keys, preventing various		protecting the user's private and symmetric keys, preventing various
	attacks, and helping the user avoid mistakes such as inadvertently		attacks, and helping the user avoid mistakes such as inadvertently
	encrypting a message for the wrong recipient. The entire list of		encrypting a message for the wrong recipient. The entire list of
	security considerations is beyond the scope of this document, but		security considerations is beyond the scope of this document, but
	some significant considerations are listed here.		some significant considerations are listed here.
	A key is no more trustworthy than the method by which it was		One should place no more trust in the data associated with a key than
	received.		in than the method by which it was obtained and in the
			trustworthiness of the entity asserting an association with the key.
			Any data associated with a key that is obtained in an untrusted
			manner should be treated with skepticism.
	Private and symmetric keys MUST be protected from disclosure to		Private and symmetric keys MUST be protected from disclosure to
	unintended parties. One recommended means of doing so is to encrypt		unintended parties. One recommended means of doing so is to encrypt
	JWKs or JWK Sets containing them by using the JWK or JWK Set value as		JWKs or JWK Sets containing them by using the JWK or JWK Set value as
	the plaintext of a JWE.		the plaintext of a JWE.
	The security considerations in RFC 3447 [RFC3447] and RFC 6030		The security considerations in RFC 3447 [RFC3447] and RFC 6030
	[RFC6030] about protecting private and symmetric keys also apply to		[RFC6030] about protecting private and symmetric keys, key usage, and
	this specification.		information leakage also apply to this specification.
	The security considerations in XML DSIG 2.0		The security considerations in XML DSIG 2.0
	[W3C.CR-xmldsig-core2-20120124], about key representations also apply		[W3C.CR-xmldsig-core2-20120124], about key representations also apply
	to this specification, other than those that are XML specific.		to this specification, other than those that are XML specific.
	The TLS Requirements in [JWS] also apply to this specification.		The TLS Requirements in [JWS] also apply to this specification.
	9. References		9. References
	9.1. Normative References		9.1. Normative References
	skipping to change at page 15, line 32 ¶		skipping to change at page 17, line 7 ¶
	[ITU.X690.1994]		[ITU.X690.1994]
	International Telecommunications Union, "Information		International Telecommunications Union, "Information
	Technology - ASN.1 encoding rules: Specification of Basic		Technology - ASN.1 encoding rules: Specification of Basic
	Encoding Rules (BER), Canonical Encoding Rules (CER) and		Encoding Rules (BER), Canonical Encoding Rules (CER) and
	Distinguished Encoding Rules (DER)", ITU-T Recommendation		Distinguished Encoding Rules (DER)", ITU-T Recommendation
	X.690, 1994.		X.690, 1994.
	[JWA] Jones, M., "JSON Web Algorithms (JWA)",		[JWA] Jones, M., "JSON Web Algorithms (JWA)",
	draft-ietf-jose-json-web-algorithms (work in progress),		draft-ietf-jose-json-web-algorithms (work in progress),
	October 2013.		November 2013.
	[JWE] Jones, M., Rescorla, E., and J. Hildebrand, "JSON Web		[JWE] Jones, M., Rescorla, E., and J. Hildebrand, "JSON Web
	Encryption (JWE)", draft-ietf-jose-json-web-encryption		Encryption (JWE)", draft-ietf-jose-json-web-encryption
	(work in progress), October 2013.		(work in progress), November 2013.
	[JWS] Jones, M., Bradley, J., and N. Sakimura, "JSON Web		[JWS] Jones, M., Bradley, J., and N. Sakimura, "JSON Web
	Signature (JWS)", draft-ietf-jose-json-web-signature (work		Signature (JWS)", draft-ietf-jose-json-web-signature (work
	in progress), October 2013.		in progress), November 2013.
	[RFC1421] Linn, J., "Privacy Enhancement for Internet Electronic		[RFC1421] Linn, J., "Privacy Enhancement for Internet Electronic
	Mail: Part I: Message Encryption and Authentication		Mail: Part I: Message Encryption and Authentication
	Procedures", RFC 1421, February 1993.		Procedures", RFC 1421, February 1993.
	[RFC2046] Freed, N. and N. Borenstein, "Multipurpose Internet Mail		[RFC2046] Freed, N. and N. Borenstein, "Multipurpose Internet Mail
	Extensions (MIME) Part Two: Media Types", RFC 2046,		Extensions (MIME) Part Two: Media Types", RFC 2046,
	November 1996.		November 1996.
	[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate		[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
	skipping to change at page 20, line 5 ¶		skipping to change at page 22, line 5 ¶
	{"kty":"oct",		{"kty":"oct",
	"k":"AyM1SysPpbyDfgZld3umj1qzKObwVMkoqQ-EstJQLr_T-1qS0gZH75		"k":"AyM1SysPpbyDfgZld3umj1qzKObwVMkoqQ-EstJQLr_T-1qS0gZH75
	aKtMN3Yj0iPS4hcgUuTwjAzZr1Z9CAow",		aKtMN3Yj0iPS4hcgUuTwjAzZr1Z9CAow",
	"kid":"HMAC key used in JWS A.1 example"}		"kid":"HMAC key used in JWS A.1 example"}
	]		]
	}		}
	Appendix B. Example Use of "x5c" (X.509 Certificate Chain) Parameter		Appendix B. Example Use of "x5c" (X.509 Certificate Chain) Parameter
	The following is an example of a JWK with a RSA signing key		The following is an example of a JWK with a RSA signing key
	represented both as a bare public key and as an X.509 certificate		represented both as an RSA public key and as an X.509 certificate
	using the "x5c" parameter:		using the "x5c" parameter:
	{"kty":"RSA",		{"kty":"RSA",
	"use":"sig",		"use":"sig",
	"kid":"1b94c",		"kid":"1b94c",
	"n":"vrjOfz9Ccdgx5nQudyhdoR17V-IubWMeOZCwX_jj0hgAsz2J_pqYW08		"n":"vrjOfz9Ccdgx5nQudyhdoR17V-IubWMeOZCwX_jj0hgAsz2J_pqYW08
	PLbK_PdiVGKPrqzmDIsLI7sA25VEnHU1uCLNwBuUiCO11_-7dYbsr4iJmG0Q		PLbK_PdiVGKPrqzmDIsLI7sA25VEnHU1uCLNwBuUiCO11_-7dYbsr4iJmG0Q
	u2j8DsVyT1azpJC_NG84Ty5KKthuCaPod7iI7w0LK9orSMhBEwwZDCxTWq4a		u2j8DsVyT1azpJC_NG84Ty5KKthuCaPod7iI7w0LK9orSMhBEwwZDCxTWq4a
	YWAchc8t-emd9qOvWtVMDC2BXksRngh6X5bUYLy6AyHKvj-nUy1wgzjYQDwH		YWAchc8t-emd9qOvWtVMDC2BXksRngh6X5bUYLy6AyHKvj-nUy1wgzjYQDwH
	MTplCoLtU-o-8SNnZ1tmRoGE9uJkBLdh5gFENabWnU5m1ZqZPdwS-qo-meMv		MTplCoLtU-o-8SNnZ1tmRoGE9uJkBLdh5gFENabWnU5m1ZqZPdwS-qo-meMv
	skipping to change at page 31, line 26 ¶		skipping to change at page 33, line 26 ¶
	Turner.		Turner.
	Jim Schaad and Karen O'Donoghue chaired the JOSE working group and		Jim Schaad and Karen O'Donoghue chaired the JOSE working group and
	Sean Turner and Stephen Farrell served as Security area directors		Sean Turner and Stephen Farrell served as Security area directors
	during the creation of this specification.		during the creation of this specification.
	Appendix E. Document History		Appendix E. Document History
	[[ to be removed by the RFC Editor before publication as an RFC ]]		[[ to be removed by the RFC Editor before publication as an RFC ]]
			-18
			o Changes to address editorial and minor issues #68, #69, #73, #74,
			#76, #77, #78, #79, #82, #85, #89, and #135.
			o Added and used Description registry fields.
	-17		-17
	o Refined the "typ" and "cty" definitions to always be MIME Media		o Refined the "typ" and "cty" definitions to always be MIME Media
	Types, with the omission of "application/" prefixes recommended		Types, with the omission of "application/" prefixes recommended
	for brevity, addressing issue #50.		for brevity, addressing issue #50.
	o Added an example encrypting an RSA private key with		o Added an example encrypting an RSA private key with
	"PBES2-HS256+A128KW" and "A128CBC-HS256". Thanks to Matt Miller		"PBES2-HS256+A128KW" and "A128CBC-HS256". Thanks to Matt Miller
	for producing this!		for producing this!
	skipping to change at page 32, line 46 ¶		skipping to change at page 35, line 4 ¶
	addressing issue #21.		addressing issue #21.
	-10		-10
	o No changes were made, other than to the version number and date.		o No changes were made, other than to the version number and date.
	-09		-09
	o Expanded the scope of the JWK specification to include private and		o Expanded the scope of the JWK specification to include private and
	symmetric key representations, as specified by		symmetric key representations, as specified by
	draft-jones-jose-json-private-and-symmetric-key-00.
	o Defined that members that are not understood must be ignored.		o Defined that members that are not understood must be ignored.
	-08		-08
	o Changed the name of the JWK key type parameter from "alg" to "kty"		o Changed the name of the JWK key type parameter from "alg" to "kty"
	to enable use of "alg" to indicate the particular algorithm that		to enable use of "alg" to indicate the particular algorithm that
	the key is intended to be used with.		the key is intended to be used with.
	o Clarified statements of the form "This member is OPTIONAL" to "Use		o Clarified statements of the form "This member is OPTIONAL" to "Use
	of this member is OPTIONAL".		of this member is OPTIONAL".
	o Referenced String Comparison Rules in JWS.		o Referenced String Comparison Rules in JWS.
	o Added seriesInfo information to Internet Draft references.		o Added seriesInfo information to Internet Draft references.
End of changes. 62 change blocks.
	116 lines changed or deleted		185 lines changed or added
This html diff was produced by rfcdiff 1.48. The latest version is available from http://tools.ietf.org/tools/rfcdiff/