JWT-SVID Specification In typical use, SVIDs are backed by an asymmetric key pair, and verification of the identity is done by proving ownership of the private key. X509-SVIDs are frequently paired with mutually authenticated TLS in order to accomplish this.
JWT-SVID Specification
In typical use, SVIDs are backed by an asymmetric key pair, and verification of the identity is done by proving ownership of the private key. X509-SVIDs are frequently paired with mutually authenticated TLS in order to accomplish this.

Using mutually authenticated TLS as the proof of ownership mechanism works well for point-to-point communication, but can’t address use cases in which TLS is terminated anywhere other than the compute endpoint that a request is ultimately destined for. Layer 7 load balancers and proxies, in particular, suffer from this problem. As a result, the community is in need of a solution which can prove identity at Layer 7, allowing the assertion to survive traversal of Layer 7 boundaries. This specification defines the JWT SVID (JWT-SVID), which is designed to provide immediate value in solving difficulties associated with asserting identity across Layer 7 boundaries, complimenting the rest of the SPIFFE specification set.

Signed-off-by: Evan Gilman <178b62e73cc3fab9e30bf27b2372c9ff92401915@scytale.io>

spiffe/spiffe