Re: [jose] Can you extend json-web-signature to bind a list of mixed objects under one signature?

Mike Jones <Michael.Jones@microsoft.com> Thu, 14 February 2013 01:30 UTC

From: Mike Jones <Michael.Jones@microsoft.com>
To: Steffen Yount <syount@wideorbit.com>, John Bradley <ve7jtb@ve7jtb.com>, Nat Sakimura <sakimura@gmail.com>, "jose@ietf.org" <jose@ietf.org>
Thread-Topic: Can you extend json-web-signature to bind a list of mixed objects under one signature?
Thread-Index: Ac4KT8+PM3Tg1XawQHW9gWltWQ4HowAAZU3w
Date: Thu, 14 Feb 2013 01:28:49 +0000
Message-ID: <4E1F6AAD24975D4BA5B1680429673943674478BC@TK5EX14MBXC285.redmond.corp.microsoft.com>
References: <397B382EC2E6D9479F9A5D6D050FB70747A84A70@WO-SFOEXCH-02.wideorbit.com>
In-Reply-To: <397B382EC2E6D9479F9A5D6D050FB70747A84A70@WO-SFOEXCH-02.wideorbit.com>
Accept-Language: en-US
Content-Language: en-US
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Subject: Re: [jose] Can you extend json-web-signature to bind a list of mixed objects under one signature?
Precedence: list

Hi Steffen,

Rather than putting this in the header, I'd put it in the payload.  I'd do that by using a JSON array or object as the payload, with array elements for each of the objects that you want to include under the signature.  Those that are binary would need to be base64url encoded in the JSON object.  You might also want metadata about each member to say what it is.

I'm imagining a payload something like this:

[
 {"type":"number", "value":123},
 {"type":"binary", "value":"A-z_4ME"},
 {"type":"string", "value":"Live long and prosper."}
]

The only thing I might do in the header is define a "cty" value to say that the content-type is one of these arrays.

Hope this is useful...

				-- Mike

-----Original Message-----
From: Steffen Yount [mailto:syount@wideorbit.com] 
Sent: Wednesday, February 13, 2013 5:19 PM
To: Mike Jones; John Bradley; Nat Sakimura; jose@ietf.org
Subject: Can you extend json-web-signature to bind a list of mixed objects under one signature?

Hi,

I'm looking for a standard way to bind a list of mixed objects (some are json and some are binary) in a token under a single signature.

I looked at the draft-ietf-jose-json-web-signature to see if JWS could work. 

Unfortunately, the draft doesn't provide a standard way to pack a list of mixed objects into a JWS token.

I could do something like tar these objects together beforehand, but building the untar handler for that in JavaScript seems like it'll be a pita...

My preferred JWS based solution could be to extend the JWS header to describe the list of mixed objects, then concatenate their base64url encoded outputs together with the dot separator, and the ship this concatenation to the signing engine.

The header describing this payload could look something like:

{
  "typ":"JWS",
  "alg":"RS256",
  "pld":[
    {"id":"oauth2",
      "cty":"JWT"},
    {"id":"saml2",
      "cty":"application/samlassertion+xml"},
    {"id":"myauthz-claims",
      "cty":"application/vnd.myauthz-claims+json"}
  ]
}

The signed token in this example would be output with 5 parts: HEAD.PLD0.PLD1.PLD2.SIG



Do you agree that multi-object support in JWS is worthwhile? 

Can you outline of a better solution?

Will you update JWS to provide a standard way to pack a list of mixed objects into a JWS token?


Thanks for your consideration,
-Steffen

Re: [jose] Can you extend json-web-signature to b… Mike Jones
Re: [jose] Can you extend json-web-signature to b… John Bradley