Re: [Acme] ACME signature mechanics

[Anders Rundgren <[e-mail]>]

When the transition to JWS has been made, human-readable ACME messages like

    {
      "type": "certificateRequest",
      "csr": "5jNudRx6Ye4HzKEqT5...FS6aKdZeGsysoCo4H9P",
      "signature": {
        "alg": "RS256",
        "nonce": "h5aYpWVkq-xlJh6cpR-3cw",
        "sig": "KxITJ0rNlfDMAtfDr8eAw...fSSoehDFNZKQKzTZPtQ",
        "jwk": {
          "kty":"RSA",
          "e":"AQAB",
          "n":"KxITJ0rNlfDMAtfDr8eAw...fSSoehDFNZKQKzTZPtQ"
   }  }  }

will rather look like

{
   "payload":"<base64>",
   "protected":"<base64>",
   "header":<base64>,
   "signature":"<base64>"
}

Which apart from being ugly JWS also requires a JSON schema validator (or similar
mechanism) to work on separate, unpacked parts of the message.

Although I don't expect this to change, you may (or may not) want to know that
clear-text JSON signatures (without the complexity of XML DSig), is not black magic,
you only have to use JSON parsers that doesn't "manipulate" input data:
https://openkeystore.googlecode.com/svn/resources/trunk/docs/jcs.html#Sample_Signature

Cheers
AndersR