Skip to content

New section: changes from RFC 8725 #22

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 2 commits into
base: main
Choose a base branch
from
Open

New section: changes from RFC 8725 #22

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
949469d
Resolve issue #18: Add 'Changes from RFC 8725' section
Aug 31, 2025
2989a62
Remove 'Major Changes' subheading from Changes section
Aug 31, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 14 additions & 0 deletions draft-ietf-oauth-rfc8725bis.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -783,6 +783,20 @@ for their reviews.

--- back

# Changes from RFC 8725 {#changes-from-rfc8725}

This document obsoletes RFC 8725 and provides several significant improvements and additions:

1. Encryption-Signature Confusion: Added mitigation for attacks where verifiers don't distinguish between successful decryption and successful signature validation.

2. PBES2 Count Limits: Added requirements to reject unreasonably large `p2c` (PBES2 Count) values to prevent DoS attacks.

3. Algorithm Verification: Added defensive checking to address incorrect reading of `alg` values as being case-insensitive.

4. Compression DoS: Added mitigation for DoS attacks resulting from abuse of compression in JWE.

5. JWT Format Confusion: Added mitigation for JWT serialization format confusion attacks.

# Document History

[[Note to RFC Editor: please remove before publication.]]
Expand Down