search

oauth-wg / oauth-selective-disclosure-jwt

https://datatracker.ietf.org/doc/draft-ietf-oauth-selective-disclosure-jwt/
Other
56 stars 31 forks source link

default hash algorithm #219

Closed TakahikoKawasaki closed 1 year ago

TakahikoKawasaki commented 1 year ago

If the SD-JWT specification specifies sha-256 as the default hash algorithm, the _sd_alg claim can be omitted and implementations can be a little simpler and more interoperable.

bc-pi commented 1 year ago

I'd suggested this somewhat in passing as part of #169. But it kinda got lost in the noise of that one. I still think it's worthwhile, however. Unless my esteemed co-editors have strong/good objections, I'd like to make this change.

danielfett commented 1 year ago

Works for me!

danielfett commented 1 year ago

Please adapt the implementation as well or assign this issue to me so that I remember to do that.

I suspect that only these lines need to be adapted for verification:

    if DIGEST_ALG_KEY not in self._sd_jwt_payload:
        raise ValueError("Missing hash algorithm")
bc-pi commented 1 year ago

222 was merged