Reader authentication x509 certificate header - #65
Open
martijnharing wants to merge 1 commit into
Open
martijnharing wants to merge 1 commit into
martijnharing wants to merge 1 commit into
Conversation
Resolves #51 Added section on public key authentication methods, specifically X.509 certificates, and their inclusion in COSE_Signature structure.
|
📄 Editor's Copy preview Preview of cdb307d; updated on every push. For review only — the official specifications are published at https://openid.net/specs/ |
Contributor
|
Discussed on today's WG call; no feedback, Christian & Andreea offered to review. Some discussions about the use of the terms verifier vs reader - Matt offered to open an issue on that, that's #67 |
c2bo
requested changes
Oct 5, 2026
| ## Public key authentication ## | ||
|
|
||
| This document specifies the following methods to authenticate the public key used for reader authentication: | ||
| - X.509 certificate |
Member
There was a problem hiding this comment.
needs another empty line to render properly
Suggested change
| - X.509 certificate | |
| - X.509 certificate |
|
|
||
| Other mechanisms may be used and are out of scope of this document. | ||
|
|
||
| When using an X.509 certificate to authenticate the reader authentication public key, that certificate shall be included as an x5chain element in the protected header of the COSE_Signature structure. The x5chain element shall contain at least 1 certificate and may contain more. The x5chain element is defined in RFC 9360. |
Member
There was a problem hiding this comment.
Since we are using COSE_Sign, we should probably allow multiple signatures here and reformulate a bit?
Suggested change
| When using an X.509 certificate to authenticate the reader authentication public key, that certificate shall be included as an x5chain element in the protected header of the COSE_Signature structure. The x5chain element shall contain at least 1 certificate and may contain more. The x5chain element is defined in RFC 9360. | |
| When using an X.509 certificate to authenticate the reader authentication public key, that certificate shall be included as an x5chain element in the protected header of the COSE_Signature structure whose signature is verified with that public key. | |
| The x5chain element shall contain at least one certificate, encoded and ordered as specified in RFC 9360. The first certificate shall contain the reader authentication public key. |
andprian
requested changes
Oct 6, 2026
|
|
||
| ## Public key authentication ## | ||
|
|
||
| This document specifies the following methods to authenticate the public key used for reader authentication: |
Collaborator
There was a problem hiding this comment.
Suggested change
| This document specifies the following methods to authenticate the public key used for reader authentication: | |
| This document specifies the following methods to convey the public key used for reader authentication: |
Collaborator
There was a problem hiding this comment.
I suggest convey , since the main idea here is that the reader public key is transported in a certificate.
In other cases we could transport it in other type of signed attestations, while still using X509 certificates to authenticate those attestations.
|
|
||
| Other mechanisms may be used and are out of scope of this document. | ||
|
|
||
| When using an X.509 certificate to authenticate the reader authentication public key, that certificate shall be included as an x5chain element in the protected header of the COSE_Signature structure. The x5chain element shall contain at least 1 certificate and may contain more. The x5chain element is defined in RFC 9360. |
Collaborator
There was a problem hiding this comment.
Suggested change
| When using an X.509 certificate to authenticate the reader authentication public key, that certificate shall be included as an x5chain element in the protected header of the COSE_Signature structure. The x5chain element shall contain at least 1 certificate and may contain more. The x5chain element is defined in RFC 9360. | |
| When using an X.509 certificate to convey the reader authentication public key, that certificate shall be included as an x5chain element in the protected header of the COSE_Signature structure. The x5chain element shall contain at least 1 certificate and may contain more. The x5chain element is defined in RFC 9360. |
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Resolves #51
Added section on public key authentication methods, specifically X.509 certificates, and their inclusion in COSE_Signature structure.