Re: [jose] Should we delete the "typ" header field

["Manger, James H" <[e-mail]>]

> typ: timestamp

By verifying a signed JOSE message you know that the holder of the corresponding private key "processed" the bytes of the content.
What it doesn't tell you is whether the signer meant:
1. They didn't look at the content (eg signing an authentication challenge; timestamping arbitrary data)
2. They are vouching for the syntax, not meaning, of the content (eg anti-malware check; syntax checker)
3. They are committing to the content (eg signing a contract; vouching for claims)

It is probably best for the distinction between these to be bound to the verification public key. For instance, including a critical extendedKeyUsage extension in the public key's certificate with a value id-kp-timeStamping [RFC3161 Time-Stamp Protocol].

Next, the content type ('cty' field) should distinguish these cases. Signing the same JWT claim set, but with 'cty' set to 'application/octet-stream', 'application/json', or 'application/jwt+json'(*) could/should imply different meanings (1, 2, and 3 respectively).

Even if there are cases where a header parameter is useful for this purpose (despite JWE/JWS nor JWT being such a use case), 'typ' as currently defined cannot be the answer as it is optional and ignorable. A recipient receiving a JOSE message with {"typ":"timestamp"...} can legitimately ignore "typ" and assume the signer is committing to the content.


(*) I don't think application/jwt+json is a defined media type. I didn't use application/jwt as it is defined in the JWT draft as a media type for JOSE messages (which is crazy), instead of a media type for a JSON object holding claims (which it should be).

--
James Manger