[jose] At a glance: JWS vs "in-object" ES6/JSON signatures

[Anders Rundgren <[e-mail]>]

ES6-compliant in-object JS/JSON signature:

   var inObjectSignedData =
     {
         // Object data expressed as JS properties
         "device": "Pump2",
         "value": 1e-18,

         // Object signature
         "signature": {
             ...Protected headers + Signature value expressed as JS properties...
         }
     };

JavaScript's JSON.parse() and JSON.stringify() suffice for "canonicalization" purposes.


Converting the above to JWS JSON Serialization you would get:

var signedData =
   {
       // Object data in a coded format
       "payload":"<payload contents>",

       // Protected headers wrapped in Base64URL
       "protected":"<integrity-protected header contents>",

       // Signature in a unique format
       "signature":"<signature contents>"
   }

ES6 was released in June 2015 so this opportunity is actually quite new.

Cheers,
Anders

http://webpki.org/ietf/draft-rundgren-predictable-serialization-for-json-tools-00.html#rfc.section.3.3