Re: [dispatch] [art] [Secdispatch] Plain text JSON digital signatures

[Samuel Erdtman <[e-mail]>]

Thanks again Carsten for sharing your thoughts

See comment inline

On Mon, May 3, 2021 at 5:37 PM Carsten Bormann <[e-mail]> wrote:

> On 2021-05-01, at 23:28, Samuel Erdtman <[e-mail]> wrote:
> >
> > Hi Carsten,
> >
> > One more thing, you wrote "Signing data at rest certainly is a use case
> that is worth addressing.". With my new fond insights (thanks) does this
> mean that you are in favor of specifying how to do enveloped signatures for
> JSON (or at least not against it)?
>
> Signing data at rest doesn’t mean that the signature then needs to be put
> into the signed object.  This is essentially adulterating that object, and
> is part of the XMLDSig “what was just signed?” practicability issue.
>

Agree the signature does not have to go into the signed document, but in my
opinion has its benefits compared to the alternatives. if puting the
signature somewhere else only referencing the signed document it would be
inconvenient to find the signature when needed (yes you could create a
system for that, there likely exists multiple of them all working slightly
differently). The alternative I see would be to create some structure that
would wrap the signed data and the signature but in that way it would not
be much different from the ascii armoring done by normal JWS, I would like
to cater for the use case where you want your doc unchanged apart from the
addition of the signature. (This is my opinion, and I´m okay with not
agreeing)


> (Such as, does my countersignature include the previous signature or not?
> What does it mean to sign a signed object?  Nothing about the existing
> signature, or does it mean I endorse the existing signature, or does it
> mean my signature actually is conditional on the validity of that existing
> signature?)
>

Yes there are questions that would need to be answered, but to me the
questions above would be application questions, what is the specific
application trying to achieve, all of the options would be possible to
technically construct.


>
> I’m not sure though I know what an “enveloped signature” is, and whether
> what I just said above even replies to what I asked.
>

With enveloped signature I was referring to when the document that is
signed will contain the signature opposed to enveloping signatures where
the signature encapsulated the document being signed. (maybe not an
established naming)


>
> Grüße, Carsten
>
>