Re: [jose] Can you extend json-web-signature to bind a list of mixed objects under one signature?

[John Bradley <[e-mail]>]

The design if JWS is that you can do anything you like with the body as long as it winds up as a bas64url encoded segment.

I don't think changing the header is the right answer.

The best thing to do is define a "cry" value and then have the index as part of the body.

You can make it a zip file or some other structure.

John B.
On 2013-02-13, at 11:42 PM, Steffen Yount <[e-mail]> wrote:

> Hi Mike,
> 
> Base64url encoding the binary parts to make them strings in a json document first would work. 
> 
> The down side to this scheme though is that these binary parts are then being doubly base64url encoded to form the JWS token. That means all the binary parts take up %178 (4/3 * 4/3) of their original space instead of just %133 (4/3) of their original space.  
> 
> Extending the definition of "cty" to allow for an array of values indicating multiple payload parts and their content-types would be better.
> 
> I could then use the first of these payload parts to supply an index into the other parts if required. The JWS header could then look something like:
> 
> {
>  "typ":"JWS",
>  "alg":"RS256",
>  "cty":[
> 	"application/vnd.myindex+json",
>      "JWT",
>      "application/samlassertion+xml",
>      "application/vnd.myauthz-claims+json"]
> }
> 
> The signed token in this example would then be output with 6 parts: HEAD.PLD0IDX.PLD1.PLD2.PLD3.SIG
> 
> 
> Is that a design change you would be willing to include in the JWS spec?
> 
> 
> Thanks,
> -Steffen
> 
> 
> -----Original Message-----
> From: [e-mail] [mailto:[e-mail]] On Behalf Of Mike Jones
> Sent: Wednesday, February 13, 2013 5:29 PM
> To: Steffen Yount; John Bradley; Nat Sakimura; [e-mail]
> Subject: Re: [jose] Can you extend json-web-signature to bind a list of mixed objects under one signature?
> 
> Hi Steffen,
> 
> Rather than putting this in the header, I'd put it in the payload.  I'd do that by using a JSON array or object as the payload, with array elements for each of the objects that you want to include under the signature.  Those that are binary would need to be base64url encoded in the JSON object.  You might also want metadata about each member to say what it is.
> 
> I'm imagining a payload something like this:
> 
> [
> {"type":"number", "value":123},
> {"type":"binary", "value":"A-z_4ME"},
> {"type":"string", "value":"Live long and prosper."} ]
> 
> The only thing I might do in the header is define a "cty" value to say that the content-type is one of these arrays.
> 
> Hope this is useful...
> 
> 				-- Mike
> 
> -----Original Message-----
> From: Steffen Yount [mailto:[e-mail]]
> Sent: Wednesday, February 13, 2013 5:19 PM
> To: Mike Jones; John Bradley; Nat Sakimura; [e-mail]
> Subject: Can you extend json-web-signature to bind a list of mixed objects under one signature?
> 
> Hi,
> 
> I'm looking for a standard way to bind a list of mixed objects (some are json and some are binary) in a token under a single signature.
> 
> I looked at the draft-ietf-jose-json-web-signature to see if JWS could work. 
> 
> Unfortunately, the draft doesn't provide a standard way to pack a list of mixed objects into a JWS token.
> 
> I could do something like tar these objects together beforehand, but building the untar handler for that in JavaScript seems like it'll be a pita...
> 
> My preferred JWS based solution could be to extend the JWS header to describe the list of mixed objects, then concatenate their base64url encoded outputs together with the dot separator, and the ship this concatenation to the signing engine.
> 
> The header describing this payload could look something like:
> 
> {
>  "typ":"JWS",
>  "alg":"RS256",
>  "pld":[
>    {"id":"oauth2",
>      "cty":"JWT"},
>    {"id":"saml2",
>      "cty":"application/samlassertion+xml"},
>    {"id":"myauthz-claims",
>      "cty":"application/vnd.myauthz-claims+json"}
>  ]
> }
> 
> The signed token in this example would be output with 5 parts: HEAD.PLD0.PLD1.PLD2.SIG
> 
> 
> 
> Do you agree that multi-object support in JWS is worthwhile? 
> 
> Can you outline of a better solution?
> 
> Will you update JWS to provide a standard way to pack a list of mixed objects into a JWS token?
> 
> 
> Thanks for your consideration,
> -Steffen
> 
> _______________________________________________
> jose mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/jose
>