Re: [jose] Canonical JSON form

Anders Rundgren <> Sat, 24 November 2018 07:16 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id F2174130DFB for <>; Fri, 23 Nov 2018 23:16:34 -0800 (PST)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -1.998
X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, LOTS_OF_MONEY=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: (amavisd-new); dkim=pass (2048-bit key)
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id fbTHZAGy1rYw for <>; Fri, 23 Nov 2018 23:16:32 -0800 (PST)
Received: from ( [IPv6:2a00:1450:4864:20::332]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 1A20A126CC7 for <>; Fri, 23 Nov 2018 23:16:32 -0800 (PST)
Received: by with SMTP id c126so13635184wmh.0 for <>; Fri, 23 Nov 2018 23:16:32 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20161025; h=subject:to:cc:references:from:message-id:date:user-agent :mime-version:in-reply-to:content-language:content-transfer-encoding; bh=PXAXQo4TFF2X+vZ88maeR7rFiZHSjdRnwYG7zjHjgTg=; b=j2YZSd1GFnMHSyOPqsDBeV/H0CrnhFhSvJyBCWsOjPX418ReK0yqAOrs/UcREjU7aA LPnJ0LVmzAyFudqYVwk4pfqny5QXeKF+aNM9Dm5xmb4R9yMieUnMvldpqjQtNJ0+gKzo TANHqLyxkKPbGwewSA0LHeB+OEJlUEapQ+engBXZuit5IkkAGdvBGcQbbErhYC8eRdi7 d6A9/FIv2+QURLEjRCDf1kx6xyflTblrAWQK70AfO4baDIxiOiS274BQ7uENStWjuuQX DOlG0h9VD58s8bJJouNtpL1n2sbYFiQerW+4upcwWmhBVFk3UI1j4jLx2C74P7uORkZ0 71hQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20161025; h=x-gm-message-state:subject:to:cc:references:from:message-id:date :user-agent:mime-version:in-reply-to:content-language :content-transfer-encoding; bh=PXAXQo4TFF2X+vZ88maeR7rFiZHSjdRnwYG7zjHjgTg=; b=H/TlmNhjHqLP6+qIWxe3I0bSgZbuN0i4zclVWyEavrxayj796lOtMJUCk4oMJWAjcL xs8S8y9m41bO5epIkUgaqJRK7TVVSkwSWytowKy3i48afS16vrfFOH41v6yhV1NWbM/5 7IV9zHVkMFK9Vsy+3AfSZh8/13uGps9Y1nHVi7BACaYSGSIhFdLXwJThtkIYmaAve0Mg lSeYpKCfQX2HUUaWcMFmnSj3U6Lo0ZkhlSX6BF9gPMBootJ+f5Y/rUBoN1F3X0Uv2e1O H4sNH6V+XzgX45Bj4+ku9XyzwU9AbNOVIA81wzjtmAnCARQQ3LfpXEE7ksbORMNRqx9X HngQ==
X-Gm-Message-State: AA+aEWZFDqZmRiklnJoBQuRGl2e6phYDqXQel9t0vkbKHNr3fV9FbYCa uftBPU8NxQ5kJV0v/TDxV8s=
X-Google-Smtp-Source: AJdET5fEBocMzPrkqnuwRENYFBMGJIYHV51fC+/NRaHycF3l0z3wMVCAtCJeTfhjEXBal8WlxlCHkw==
X-Received: by 2002:a7b:c315:: with SMTP id k21mr15872228wmj.145.1543043789621; Fri, 23 Nov 2018 23:16:29 -0800 (PST)
Received: from [] ( []) by with ESMTPSA id a11sm8039856wmh.26.2018. (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 23 Nov 2018 23:16:28 -0800 (PST)
To: Bret Jordan <>
Cc: David Waite <>, Jim Schaad <>, Carsten Bormann <>,
References: <> <> <> <> <> <> <> <> <> <> <01fd01d47f5f$4c4889f0$e4d99dd0$> <> <> <> <> <> <>
From: Anders Rundgren <>
Message-ID: <>
Date: Sat, 24 Nov 2018 08:16:26 +0100
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:60.0) Gecko/20100101 Thunderbird/60.3.1
MIME-Version: 1.0
In-Reply-To: <>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Archived-At: <>
Subject: Re: [jose] Canonical JSON form
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Javascript Object Signing and Encryption <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Sat, 24 Nov 2018 07:16:35 -0000

Since Open Banking's use of clear text signatures (enabled through HTTP
bindings and the downsides of that [1]), TEEP/OTrP's need for clear
text object type IDs (and the implications of that with respect to
signature validation [2]), as well as my own use of a hash only in a
novel counter signature scheme [3], haven't spurred a single comment
relating to the actual applications and how they {c|sh}ould make best
use of the existing or enhanced JOSE stack, there seems to be little
point continuing these discussions within the IETF.

I'm still waiting for messages pointing out why JCS isn't working
(beyond anecdotes from the XML/WS* era).  Since detached JWS signatures
is already a de-facto standard in Open Banking, claims that data to be
signed SHOULD be encoded in alien formats and then be embedded in specific
signature containers can safely be ignored unless somebody has a very compelling
security story to share with us.

Anyway, VmWare have a US patent on JSON clear text signatures [6] so maybe
it is toast from that perspective as well?  Although I'm not a patent
lawyer this smells prior art by a mile!  To me it only adds credibility
to the idea since the concepts are virtually identical:-)

 From the CBOR list I have gathered that the CBOR counterpart to JCS [4,5]
apparently is in a pretty bad shape.  Carsten, you have a new job :-)