Re: [dispatch] Other uses of JCS (JSON Canonicalization Scheme)

[Anders Rundgren <[e-mail]>]

On 2019-05-19 20:57, Anton Tveretin wrote:
Hi Anton,
> This does not explain why anyone needs to inflate plain text documents of NGMTP-C9 [http://antontveretin.000webhostapp.com/ngmtp/] into JSON. 

If this http://antontveretin.000webhostapp.com/ngmtp/ngmtp_c9_cfdt.pdf is what you refer to I believe we are in different parts of the payment landscape.  Saturn is exclusively dealing with the authorization of payments including acquiring the information needed to get the actual payment system (backend) to perform its task.  These solutions are heavy into crypto and not particularly dense [1].

If you consider the four-corner model (Payee, Payee's Bank, Payer, Payer's Bank) all these entities must be be identified and secured in some way and that piece of the pudding is completely on fire these day, particularly with respect to the Payer and Payee.


> And why does the data exchange bypass the (implied) payment system? As a payee, I need money and not "authorization".

Right, but before that can happen authorization must happen in some way. This one-page "blueprint" illustrates the steps in my original posting:
https://cyberphone.github.io/doc/saturn/saturn-authorization.pdf


> Of course, there is nothing wrong with JCS and its usage. Maybe I will incorporate it into the next version of the NGMTP-C9, or conversely.

This year the EU PSD2 directive gets into power which is intended to open the payment market.  Since the directive was written by lawyers will minimal knowledge of what is technically and commercially possible, it seems like an excellent opportunity putting new things to work including JCS.  A bunch of IETFers are "retrofitting" OAuth for this market and purpose while I'm rather "upgrading" the card concept [2].

If you or anybody else want to discuss payment [authorization] systems, please contact me privately.

thanx,
Anders

1] Authentic sample of step #3 in the "blueprint".  It features a JCS-enhanced version of JWE providing encryption metadata in clear.

{
   "@context": "https://webpki.github.io/saturn/v3",
   "@qualifier": "PayerAuthorization",
   "providerAuthorityUrl": "https://mobilepki.org/webpay-payerbank/authority",
   "paymentMethod": "https://bankdirect.net",
   "encryptedAuthorization": {
     "algorithm": "A256GCM",
     "encryptedKey": {
       "algorithm": "ECDH-ES",
       "publicKey": {
         "kty": "EC",
         "crv": "P-256",
         "x": "TfCrhFwZRU_ea7lUWwRi3HkuyT2yF9IxN5xKh2khjlk",
         "y": "nZFwxLP0TvFXD2xPKzRTIGevgLjpiMw2BP86hszj5x4"
       },
       "ephemeralKey": {
         "kty": "EC",
         "crv": "P-256",
         "x": "KZX-u1p40KGQpWreSdLRa8qUfa8jV6FNXe9AAhxE7MI",
         "y": "NOPuK5tgM8BPZB5xHAGzK7R609RnLHYA-le_3vrKdmE"
       }
     },
     "iv": "5cU6d7DgjRKQy87h",
     "tag": "daSM2zkSuXvk5sD2_fB5TQ",
     "cipherText": "LHJabqaB0ZCHOmnxuWiEHNZDNCabMg4Zkw8X7Uy4xvFYmV80Z7NtNg9auiX8dzRGYxdtXmzQXJZeMMen5jmn6jcw6v0p9uaGoGkIxMT3Clwp2elnJYHgz0iJU5aKfxHm6ArF77Jn45YrAF0ur9MbD3a-sZL6OG5w91rS4xOVvjXkqhtuxBTygkHgXovhHWfMqiW2f6C0-nBbwWvdyZ7FCNM7acaPRlrUsvkkZe8KNviJpn7Rh8LXDR8TV-ycH05kET4pnGFvvM4qAs9qyqNyQa4ppz7V0dWFs8OSKbNqliPSaehIhcgKH4m1fD58IU2xMAmjTLAOAHpNRIwdeYic_P9Lx1FYrIEj-5snaqwyrXIxiOEHUPa_K0VzyE2LyP_lFecw0e3dzsivT59Oi6aE9RdNuKw09TtRqYE6ljYlxRTtfuZw8ySpfMxhN1syEA34r0U7utb9ToDhjaRsoSqF_DE1ExFFaFu0OMLOmlq947nc11zNRaPyuALRpe4Qb1niGE5Y-FQAluz0KMCP5CXBLC6zM0VfgodImH536PZifJ_aHvYsn-GEVyC9AamG_LkUgR4b8Zm3bLsTfcWUngNiirZgQErsrfK2VIT54VKkB9LOlC-uDtiaPstYRyL31IPCAp6uIgiDUYzGZNUltLIlSsUNJkzM9DNSiO9SpLoLBT94BHz66r4ebcIPfzeCC1Lt-7YyW9vTF5aBQqIZrD9eh6hhl2vs8rXqJqnEcNUv8X_Xce3t8H5H73XVpgYAiMQ98_imPozrSpIVp0R8TPBtIY93fy1BvEQXzIYKxx0HLv-JfmJ-KQLNggVd3LvuDrJE-t2PfPWDCwXDk-ukIPNaWQWwk5seMURfBVqZKmp3"
   }
}

2] Web UI emulator: https://cyberphone.github.io/doc/saturn/ui-demo