papers/transport-vs-jwt/refs.bib

@misc{rfc7519,
  author       = {Michael B. Jones and John Bradley and Nat Sakimura},
  title        = {{JSON Web Token (JWT)}},
  howpublished = {RFC 7519, IETF},
  year         = {2015},
  url          = {https://www.rfc-editor.org/rfc/rfc7519},
}

@misc{rfc7518,
  author       = {Michael B. Jones},
  title        = {{JSON Web Algorithms (JWA)}},
  howpublished = {RFC 7518, IETF},
  year         = {2015},
  url          = {https://www.rfc-editor.org/rfc/rfc7518},
}

@misc{rfc7515,
  author       = {Michael B. Jones and John Bradley and Nat Sakimura},
  title        = {{JSON Web Signature (JWS)}},
  howpublished = {RFC 7515, IETF},
  year         = {2015},
  url          = {https://www.rfc-editor.org/rfc/rfc7515},
}

@misc{rfc7517,
  author       = {Michael B. Jones},
  title        = {{JSON Web Key (JWK)}},
  howpublished = {RFC 7517, IETF},
  year         = {2015},
  url          = {https://www.rfc-editor.org/rfc/rfc7517},
}

@misc{rfc8446,
  author       = {Eric Rescorla},
  title        = {{The Transport Layer Security (TLS) Protocol Version 1.3}},
  howpublished = {RFC 8446, IETF},
  year         = {2018},
  url          = {https://www.rfc-editor.org/rfc/rfc8446},
}

@misc{ietfjwtbcp,
  author       = {Yaron Sheffer and Dick Hardt and Michael B. Jones},
  title        = {{JSON Web Token Best Current Practices}},
  howpublished = {RFC 8725, IETF BCP 225},
  year         = {2020},
  url          = {https://www.rfc-editor.org/rfc/rfc8725},
}

@misc{auth0algnone,
  author       = {Tim McLean},
  title        = {{Critical vulnerabilities in JSON Web Token libraries}},
  howpublished = {Auth0 advisory; CVE-2015-9235 and family},
  year         = {2015},
  url          = {https://auth0.com/blog/critical-vulnerabilities-in-json-web-token-libraries/},
}

@misc{auth0algconf,
  author       = {Tim McLean},
  title        = {{JWT algorithm confusion: HS256 with RS256 public key}},
  howpublished = {Public advisory},
  year         = {2016},
  note         = {See e.g. CVE-2016-10555, CVE-2016-5431, CVE-2018-1000531},
}

@misc{donenfeld2017wireguard,
  author       = {Jason A. Donenfeld},
  title        = {{WireGuard: Next Generation Kernel Network Tunnel}},
  howpublished = {NDSS},
  year         = {2017},
  url          = {https://www.wireguard.com/papers/wireguard.pdf},
}

@misc{perrin2018noise,
  author       = {Trevor Perrin},
  title        = {{The Noise Protocol Framework}},
  howpublished = {Specification rev. 34},
  year         = {2018},
  url          = {https://noiseprotocol.org/noise.html},
}

@misc{marlinspike2016x3dh,
  author       = {Moxie Marlinspike and Trevor Perrin},
  title        = {{The X3DH Key Agreement Protocol}},
  howpublished = {Signal specification},
  year         = {2016},
  url          = {https://signal.org/docs/specifications/x3dh/},
}

@misc{ylonen2006rfc4251,
  author       = {Tatu Ylönen and Chris Lonvick},
  title        = {{The Secure Shell (SSH) Protocol Architecture}},
  howpublished = {RFC 4251, IETF},
  year         = {2006},
  url          = {https://www.rfc-editor.org/rfc/rfc4251},
}

@misc{spiffe,
  author       = {{SPIFFE Authors}},
  title        = {{The SPIFFE Standards: Workload Identity for Distributed Systems}},
  howpublished = {Specification},
  year         = {2023},
  url          = {https://spiffe.io/docs/latest/spiffe-about/spiffe-concepts/},
}

@inproceedings{cremers2017tls13,
  author       = {Cas Cremers and Marko Horvat and Jonathan Hoyland and Sam Scott and Thyla van der Merwe},
  title        = {{A Comprehensive Symbolic Analysis of TLS 1.3}},
  booktitle    = {ACM CCS},
  year         = {2017},
}

@inproceedings{kfischlin2020,
  author       = {Marc Fischlin and Felix Günther and Christian Janson},
  title        = {{Robust Channels: Handling Unreliable Networks in the Record Layers of QUIC and DTLS 1.3}},
  booktitle    = {Eurocrypt},
  year         = {2022},
}

@inproceedings{schwabe2020mlkem,
  author       = {Roberto Avanzi and Joppe Bos and Léo Ducas and Eike Kiltz and Tancrède Lepoint and Vadim Lyubashevsky and John M. Schanck and Peter Schwabe and Gregor Seiler and Damien Stehlé},
  title        = {{CRYSTALS-Kyber Algorithm Specifications and Supporting Documentation}},
  booktitle    = {NIST PQC submission},
  year         = {2020},
}

@misc{nistfips203,
  author       = {{NIST}},
  title        = {{FIPS 203: Module-Lattice-Based Key-Encapsulation Mechanism Standard}},
  howpublished = {Federal Information Processing Standard},
  year         = {2024},
}

@inproceedings{krawczyk2010hkdf,
  author       = {Hugo Krawczyk},
  title        = {{Cryptographic Extraction and Key Derivation: The HKDF Scheme}},
  booktitle    = {CRYPTO},
  year         = {2010},
}

@misc{boringssl-design,
  author       = {{Google BoringSSL Authors}},
  title        = {{BoringSSL Design and Threat Model Documentation}},
  howpublished = {Project documentation},
  year         = {2024},
  url          = {https://boringssl.googlesource.com/boringssl/+/HEAD/PORTING.md},
}

@misc{quic-rfc9000,
  author       = {Jana Iyengar and Martin Thomson},
  title        = {{QUIC: A UDP-Based Multiplexed and Secure Transport}},
  howpublished = {RFC 9000, IETF},
  year         = {2021},
  url          = {https://www.rfc-editor.org/rfc/rfc9000},
}