Versions Compared

Version Old Version 2 New Version 3
Changes made by

Chris Wood

David Plews

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

Item

Description

Issuer

Private Key Held By

CSR Generated by

Certificate Generated by

Action required by LFI

JWKS

Enc1

Used by the TPP to encrypt PII sent to the OFP that can only be read by the LFI

The PII payloads are encrypted using the LFI’s public key in the JWKS

The LFI decrypts them using their private key

OFTF

LFI

LFI

LFI

Yes

LFI’s JWKS identified by the jwks_url in the OFP’s well-known endpoint

Hosted in LFI’s JWKS on OFTF

Ozone can provide scripts to generate the CSR if requested by the LFI

3. Creating certificates

These steps are repeated for S1 S3 C4 Sig2 Sig3 - where the private keys is held by the API Hub

  1. Ozone to generate private keys for the certificates

  2. Ozone to generate CSRs and hand over to LFI

  3. LFI to generate certificates on OFTF Sandbox directory

  4. LFI to provide JWKS URL and KID

These steps are repeated for C3 S4 Sig3 - where the private key is held by the LFI

  1. LFIto generate private key for the certificate

  2. LFI to generate CSR

  3. LFI to generate the certificate from OFTF Sandbox directory

  4. LFIto provide JWKS URL and KID