HPKE algorithm clarification #781

Activity

1. brentzundel

   added this to the Final 1.1 milestone on Aug 20, 2026
2. brentzundel commented on Aug 20, 2026

   

   brentzundel

   on Aug 20, 2026

   Collaborator

   More actions

   From the discussion today: The group is not sure what the normative effect of this sentence is. Some additional clarity here would be helpful in providing understanding. What changes if this line is removed? Should this be pointing to the IANA registry?
3. martijnharing commented on Aug 26, 2026

   

   martijnharing

   on Aug 26, 2026

   ContributorAuthor

   More actions

   The issue with the current text is that it's not clear what exactly it means, so it's difficult to say what changes if we remove it.

   If it means that you must use one of the algorithms from ietf-jose-hpke-encrypt then removing it means you can also use algorithms that are not defined in ietf-jose-hpke-encrypt.
   If it means the algorithm MUST be a HPKE JWE algorithm it probably doesn't change anything because it is effectively saying "if you do hpke, you have to use an hpke algorithm."
   If it means something else then it depends on what that other meaning is.
4. brentzundel

   added

   discuss

   on Sep 18, 2026
5. dpostnikov commented on Sep 18, 2026

   

   dpostnikov

   on Sep 18, 2026

   Collaborator

   More actions

   Something like this?
   Hybrid Public Key Encryption (HPKE) may be used for encrypted responses. If HPKE is used, the alg value MUST point to an HPKE algorithm.
6. c2bo commented on Oct 25, 2026

   

   c2bo

   on Oct 25, 2026

   Member

   More actions

   How about rewording the whole section a bit (and fixing some typos etc):

   Hybrid Public Key Encryption (HPKE) MAY be used for encrypted responses.
   If HPKE is used, the Authorization Response MUST be encrypted as a JWE as defined in [@!I-D.ietf-jose-hpke-encrypt], using either the Integrated Encryption or the Key Encryption Key Management Mode.
   The JWE alg Header Parameter MUST identify a JWE algorithm that uses HPKE according to the processing rules of [@!I-D.ietf-jose-hpke-encrypt].
   This includes the algorithms defined in [@!I-D.ietf-jose-hpke-encrypt] as well as any other such algorithm registered in the IANA "JSON Web Signature and Encryption Algorithms" registry [@IANA.JOSE].

   Additionally, a session_info structure MUST be calculated and utilized for encryption and decryption independently by the Wallet and the Verifier.
   This ensures that decryption fails closed when the session information needed for verification of the credential is invalid.
   The session_info structure is specific to the response modes direct_post.jwt and dc_api.jwt.

   When the presentation is invoked via redirects, such as with Response Mode direct_post.jwt, the encoding is as follows:
   ...