Re: [jose] Pete Resnick's Discuss on draft-ietf-jose-json-web-signature-33: (with DISCUSS and COMMENT)

["Jim Schaad" <[e-mail]>]

> -----Original Message-----
> From: Mike Jones [mailto:[e-mail]]
> Sent: Tuesday, October 14, 2014 5:46 AM
> To: Pete Resnick; The IESG
> Cc: [e-mail]; [e-mail]; draft-ietf-jose-json-web-
> [e-mail]
> Subject: RE: Pete Resnick's Discuss on draft-ietf-jose-json-web-signature-33:
> (with DISCUSS and COMMENT)
> 
> > -----Original Message-----
> > From: jose [mailto:[e-mail]] On Behalf Of Mike Jones
> > Sent: Saturday, October 04, 2014 6:58 PM
> > To: Pete Resnick; The IESG
> > Cc: [e-mail]; [e-mail];
> > draft-ietf-jose-json-web- [e-mail]
> > Subject: Re: [jose] Pete Resnick's Discuss on
> > draft-ietf-jose-json-web-signature-
> > 33: (with DISCUSS and COMMENT)
> >
> > Thanks for your review, Pete.  I've added the working group to the thread.
> > Replies are inline below...
> >
> > > -----Original Message-----
> > > From: Pete Resnick [mailto:[e-mail]]
> > > Sent: Wednesday, October 01, 2014 9:14 PM
> > > To: The IESG
> > > Cc: [e-mail]; draft-ietf-jose-json-web-
> > > [e-mail]
> > > Subject: Pete Resnick's Discuss on
> > > draft-ietf-jose-json-web-signature-33: (with DISCUSS and COMMENT)
> > >
> > > --------------------------------------------------------------------
> > > --
> > > COMMENT:
> > > --------------------------------------------------------------------
> > > --
> > >
> > > 3.2:
> > >
> > >    In the JWS JSON Serialization, a JWS object is represented as the
> > >    combination of these four values,
> > >       BASE64URL(UTF8(JWS Protected Header)),
> > >       JWS Unprotected Header,
> > >       BASE64URL(JWS Payload), and
> > >       BASE64URL(JWS Signature)
> > >
> > > Why is the Payload (a) part of the serialization and (b) base64ed?
> > > Are you saying that the only way I can use JWS is to include the
> > > payload as part of the JOSE object? Why can't it be a separate
> > > thing? Also, why does it
> > have to be base64ed?
> > > It could be a UTF-8 string, or it could be a large binary object
> > > that I'm using in a non-JSON context, neither of which I want to
> > > bloat by base64ing it. This seems bogus.
> >
> > It is base64url encoded because JSON has no way of representing
> > arbitrary octet sequences.  This enables the "binary object" case that
> you're describing to work.
> > Also note that this was extensively discussed by the working group in
> > the context of issue #26 http://trac.tools.ietf.org/wg/jose/trac/ticket/26.

Pete, would a pointer to Appendix F at some point be useful?  This describes how to do detached content.