It seems clear that there are no implementations today that support the "oth" element, i.e., that support RSA with a modulus with multiple factors. At least some of them simply ignore the "oth" element, which unfortunately leads to incorrect operation. I would propose something of the following form in JWA:
""" If the consumer of a JWK does not support multi-prime RSA moduli and it encounters a private key that includes the "oth" parameter, then it MUST reject the key. """
_______________________________________________ jose mailing list [email protected] https://www.ietf.org/mailman/listinfo/jose
