[dispatch] Other uses of JCS (JSON Canonicalization Scheme)

[Anders Rundgren <[e-mail]>]

Since the value of clear text messaging has been unilaterally declared to be zero, maybe other and more sophisticated uses of JCS could be of some interest?

In Saturn[1] JCS is used in many different ways including for signatures and encryption.
However, the ability to only take a hash of JSON objects has also been put to good work.  Yes, "hashable" JSON is what JCS really is.

Slightly simplified....
1. Merchant creates a signed PaymentRequest in the form of a JSON object and sends it to the User for authorization.
2. The User (SW) creates a JSON object with various properties including a timestamp, account ID and a hash of the received PaymentRequest.
3. The User (SW) signs the new JSON object using an account- and user-specific authorization private key.
4. The User (SW) encrypts the signed JSON object (User authorization) using a bank-specific encryption public key.
5. The User(SW) returns the encrypted authorization object + URL to the User's Bank to the Merchant.
6. The Merchant puts the PaymentRequest, the encrypted User authorization object and a Merchant receive account in a new JSON object.
7. The Merchant counter-signs the new JSON object and sends it to the User's Bank for "redemption".
8. The User's Bank verifies the inner and outer Merchant signatures and decrypts the User authorization object.
9. The User's Bank verifies that the User authorization object is signed by a key matching the claimed account ID.
10. If the hash of the Merchant-supplied PaymentRequest matches that of the hash in the User authorization object the request is considered valid.
Next follows the actual payment transaction...

Using JWS as is, the PaymentRequest would need to be duplicated in step #2.
This may not seem like a big deal but why duplicate data if not necessary?

JCS is BTW used some 8 times above.

Quirky, ugly and potentially error-prone signature solutions like TEEP's OTrP also isn't my cup of tea: https://mailarchive.ietf.org/arch/msg/dispatch/ULq1QoecXC0xXu6M5o6m3xPtUPQ

Thanx,
Anders

1] https://cyberphone.github.io/doc/saturn