Yes, it was considered, discussed, and rejected. The reason being “at_hash” has a somewhat convoluted definition (left-bits of a hash of an access token in the context of a JOSE object, etc), to fit some of the design constraints of ID Tokens. DPoP proofs do not have those same constraints. DPoP opted, correctly in my opinion, to simplify this by declaring a single hashing algorithm and using its full output value. Cryptographic agility would be achieved by defining a new claim with a new hashing algorithm.
— Justin > On Mar 28, 2022, at 10:41 AM, Rohan Mahy <rohan=40wire....@dmarc.ietf.org> > wrote: > > Hi, > Did you consider using the (already IANA registered) at_hash claim defined > in: > https://openid.net/specs/openid-connect-core-1_0.html#CodeIDToken > <https://openid.net/specs/openid-connect-core-1_0.html#CodeIDToken> > instead of defining a new ath claim? > > It seems like if we don't use at_hash we should explain why ath is > better/different. > Thanks, > -rohan > _______________________________________________ > OAuth mailing list > OAuth@ietf.org > https://www.ietf.org/mailman/listinfo/oauth
_______________________________________________ OAuth mailing list OAuth@ietf.org https://www.ietf.org/mailman/listinfo/oauth
