W004

Ref	W004
Organisation	OBIE (but applies to all ASPSPs and TPPs)
Date raised	04 Jan 2018
Priority	HIGH
Summary	All participants are exempted from supporting the ability to issue JWTs using PS256 digital signing algorithm.
Policy/standard affected	Open Banking Security Profile - Implementer's Draft v1.1.0
Duration (end date)	Extended to 13 Mar 2019
Status	EXPIRED
Approved by	IE Trustee
Approved date	12 Jan 2018
Comments	Recommendation has been approved by TDA

Description	Several ASPSPs are unable to issue JWTs that are signed with the PS256 algorithm. This algorithm, PS256, is the mandated algorithm for signing of JWTs under both the OB and FAPI standard that supports the RSA certificates created by Open Banking. Many of the ASPSPs have confirmed that they will be unable to issue JWTs signed by PS256 as a result of poor library support in their vendor applications and internal approved security libraries. A waiver should be granted for all ASPSP participants and OB itself not to be required to support the issuance of PS256 signed JWTs. This has an ecosystem impact in that collectively the ecosystem is not specification compliant in this one small area.
Risk assessment	Low
Mitigating controls	Alternative cipher suite available.
Impact if refused	High
Financial cost (if any) £
Resource cost (if any) £