ID Token encryption (JWE) according to OIDC specification

[megical-access]

Hi, does ORY have any plans to support ID token encryption in the future? ID token may include sensitive claims about user and at least in Finnish Trust Network it is mandatory feature. I think that in the near future also eIDAS context will require it for some ACRs.

[vinckr]

Hello @megical-access

Ory does take security seriously and uses various encryption methods to secure tokens and keys. For instance, Ory OAuth2 and OpenID Connect generate two cryptographic keys for each Ory Network project, and these keys are stored securely and encrypted at rest using AES256-GCM and the system secret (source).
Additionally, Ory Network encrypts tokens per default at rest using XChaCha20 Poly1305 (source).

If this is something you would like to use in your company, I would recommend to contact the team and start a conversation!

[gi-wg2]

The JWT generated by Hydra are signed, so integrity is protected.

A signed JWT does not give any confidentiality, as the content is not encrypted. If confidentiality is required, Hydra would need to support generating a JWE.

If I understand the question correctly, it is not related to how encryption at rest is done but if support for JWE is planned.

[vinckr]

@gi-wg2
Thanks for the clarification! I guess this is the RFC that is related to it?

I think it would be a good addition, but AFAIK it is not directly planned yet.
Feel free to reach out if you want to sponsor or discuss the feature.