Re: [dispatch] [art] [Secdispatch] Plain text JSON digital signatures

[Carsten Bormann <[e-mail]>]

Signing data at rest certainly is a use case that is worth addressing.

“Represented in JSON” is a weird way to say that the data model that describes those data at rest is somehow compatible with the JSON data model (which isn’t really fully defined, but that is a problem that may not hurt you).  So if you have a deterministic way to transform your data at rest into the JSON-like data model subset supported by RFC8785 (which is in turn based on the RFC7493 I-JSON subset), you then can use RFC8785 to generate a text string that (using UTF-8’s deterministic encoding) can in turn be used as a signing input for well-known signature schemes such as JOSE or COSE.

This is pretty much what XMLDSig set out to do, except that the XML data model is even less well-defined and generating a deterministic signing input from that is even more interesting.  Small matters of interoperability :-)

None of this has anything to do with “clear text” or “plain text", which is an exceedingly bad label to apply to signing data at rest that are believed to be convertable to an RFC8785-subset JSON text.

Grüße, Carsten