Re: [art] [Secdispatch] Plain text JSON digital signatures

[Stefan Santesson <[e-mail]>]

How is this different/better than implementing RFC 7797 and apply the
header b64=false in order to carry plaintext JSON in the payload?

/Stefan


On 2021-04-28 04:29, Bret Jordan wrote:
> Luckily this time we have RFC8785 that solves the canonicalization
> problem for JSON. 
>
> Bret 
>
> Sent from my Commodore 64
>
> PGP Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 0050
>
>> On Apr 27, 2021, at 7:39 PM, Dick Hardt <[e-mail]> wrote:
>>
>> 
>> I am supportive of this work, and would also be willing to work
>> towards a PS. I am seeing rapid growth in the demand to embed JWS in
>> JWS.
>>
>> Given my experience with XML-DSig (see below) making it more XML-DSig
>> like does not sound like a good thing.
>>  
>> For any interested in some JWT history, when we were brewing up what
>> became OAuth 2.0, we did not want to tie a token format to the
>> implementation as many deployments had their own proprietary token
>> formats -- but we knew new deployments would benefit from
>> standardizing a token.
>>
>> Our requirements were:
>> - URL safe (access tokens at the time were often passed as a query
>> parameter -- I know, not the best idea, but working with what
>> people wanted)
>> - HTTP header safe
>> - richer than name / value pairs
>>
>> Options we considered:
>> ASN.1 - the 60s are calling and want their data back
>> XML-DSig - not URL safe, large size, and I personally had many scars
>> canonicalizing XML. (An earlier company of mine had a contract to
>> build XML-DSig libraries for a few languages)
>>  
>> JSON was becoming very cool at that time, and with base 64 URL safe
>> encoding the string, it was URL safe, and treating the JSON text as
>> binary dealt with the canonicalization concerns -- and JSON
>> canonicalization did not exist.
>>
>> Using a dot as the separator between header, payload, and signature
>> made it easy to parse. The dot was URL safe, but not in the base 64 set.
>>
>> And Simple Web Tokens were born -- to be renamed JSON Web Tokens.
>>
>> /Dick
>>
>>
>>
>>
>> ᐧ
>>
>> On Tue, Apr 27, 2021 at 8:28 AM Bret Jordan <[e-mail]>
>> wrote:
>>
>>     Dear Dispatch,
>>
>>     Anders Rundgren, Samuel, Erdtman, and I have been working on an
>>     ID for your consideration. This document describes how to use JWS
>>     and JCS to create plain-text JSON signatures. The abstract reads
>>     as follows:
>>
>>     This document describes a method for extending the scope of the
>>     JSON Web Signature (JWS) standard, called JWS/CT.  By combining
>>     the detached mode of JWS with the JSON Canonicalization Scheme
>>     (JCS), JWS/CT enables JSON objects to remain in the JSON format
>>     after being signed (aka "Clear Text" signing).  In addition to
>>     supporting a consistent data format, this arrangement also
>>     simplifies documentation, debugging, and logging.  The ability
>>     to embed signed JSON objects in other JSON objects, makes the use
>>     of counter-signatures straightforward.
>>
>>     The data tracker page for this:
>>     https://datatracker.ietf.org/doc/draft-jordan-jws-ct/
>>
>>     As you know there are large ecosystems that needs digital
>>     signatures for plain text JSON data, meaning where the JSON data
>>     is not base64 encoded. This ID provides a solution using existing
>>     IETF RFCs to make this work. Further, this work looks to be
>>     adopted by many groups and organizations from financial services,
>>     threat intelligence, and incident response.
>>
>>     We are not sure what direction would be best for this work in the
>>     IETF, should we send to the ISE for publication or do you want to
>>     create a working group. Ultimately there is a lot of work that
>>     could be done in this space to meet the needs of the market. We
>>     would be happy with releasing these IDs for ISE publication, or
>>     for creating a working group to move them forward. It is just
>>     important to note that the market is in desperate need of these
>>     solutions. If you want to take it for a spin, there is a JWS/CT
>>     playground at: https://mobilepki.org/jws-ct
>>
>>     Thanks
>>     Bret
>>
>>     -- 
>>
>>     Sent from my TI-99/4A
>>
>>     PGP Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415
>>     0050
>>     _______________________________________________
>>     art mailing list
>>     [e-mail]
>>     https://www.ietf.org/mailman/listinfo/art
>>
>
> _______________________________________________
> Secdispatch mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/secdispatch