[jessaustin]

All points well taken. Still, people need to pack stuff into cookies. There are probably some modules for some environments that do this in unimpeachable fashion. How likely is the average developer to reliably pick those modules, or (haha) just code up the equivalent without using a module? At least a flawed consensus around JWT gets people looking at it.

So now what? The draft [0] hasn't expired yet, so it's possible they'll just rip out the public-key stuff. What should they add to answer your reservations about CTR+HMAC?

[0] http://self-issued.info/docs/draft-ietf-oauth-json-web-token...

[jessaustin]

Apparently the drafts have been sent to the editor so they can't be changed. [1] Oh well!

[1] http://self-issued.info/?p=1323