Mike Jones: self-issued

The OpenID Connect working group has published the initial version of the OpenID Connect Token Hash Algorithm Implementer’s Guide 1.0.

The World Wide Web Consortium (W3C) has published the Web Authentication (WebAuthn) Level 3 specification as a W3C Recommendation, meaning that it now a completed standard.

The JOSE and COSE HPKE specs, “Use of Hybrid Public Key Encryption (HPKE) with JSON Web Encryption (JWE)” and “Use of Hybrid Public-Key Encryption (HPKE) with CBOR Object Signing and Encryption (COSE)” are continuing to progress towards completion.

I gave a presentation at the 2026 OAuth Security Workshop in Leipzig describing the actions we took when an actionable security vulnerability was discovered affecting numerous OpenID and OAuth specifications.

Congratulations to Mike Prorock and Orie Steele on the publication of “ML-DSA for JSON Object Signing and Encryption (JOSE) and CBOR Object Signing and Encryption (COSE)” as RFC 9964!

I’m pleased to report that the Final 1.1 OpenID Federation specifications have been published.

I gave the following presentation on behalf of the OpenID Connect Working Group at the Monday, April 27, 2026 OpenID Workshop at Cisco: OpenID Connect Working Group Update (PowerPoint) (PDF) And as has become traditional, I also gave this invited “101” se…

I gave the presentation “The Journey to OpenID Federation 1.0 and the Road Ahead” at the 4th International Workshop on Trends in Digital Identity (TDI 2026) in Verona, Italy.

I gave the presentation “The Post-Quantum Apocalypse Is Already Upon Us” at the 4th International Workshop on Trends in Digital Identity (TDI 2026) in Verona, Italy.

The FIDO Alliance has published the CTAP 2.3 Specification.

The OpenID Connect Relying Party Metadata Choices 1.0 specification has been approved as a Final Specification by the OpenID Foundation membership.

The final OpenID Federation 1.0 specification was published today.

Implementers of OpenID Federation gathered at the 2026 Trust and Internet Identity Meeting Europe (TIIME) unconference in Amsterdam on Friday, February 13, 2026 to test their implementations with one another. 12 people with 9 implementations and from 9 co…

I had the pleasure of presenting an overview of OpenID Federation during the 2026 Trust and Internet Identity Meeting Europe (TIIME) unconference in Amsterdam.

The OpenID Federation 1.0 specification contains two kinds of functionality: Protocol-independent federation functionality used for establishing trust and applying policies in multilateral federations, and Protocol-specific federation functionality that c…

The “Use of Hybrid Public-Key Encryption (HPKE) with CBOR Object Signing and Encryption (COSE)” specification has been updated to align with pertinent changes recently applied to the JOSE HPKE specification.

I was encouraged by Pål Axelsson to hold an unconference discussion giving an overview of OpenID Federation during the 2025 Internet2 Technology Exchange conference in Denver.

I am my wife Becky’s password manager.

The OpenID Federation 1.0 specification has started its 60-day review to become an OpenID Final Specification.

A design team formed and met after the JOSE working group meeting at IETF 124 in Montreal to discuss possible next steps for the JOSE HPKE specification.