Re: [jose] A modest proposal for JSON-izing JW*

[Mike Jones <[e-mail]>]

We already have it in a separate pair of drafts that are ready for submission as working group drafts once the rechartering is complete.  That was what the working group decided in Atlanta to have happen.  And as I understand it, the rechartering probably won’t take much longer.

What’s most developer-friendly depends upon the developer’s use cases.  If they’re only using the compact serialization (which for instance, Mozilla Persona, OpenID Connect, and I believe Dick Hardt’s application all do), they’re more developer-friendly without also making the developer skip the parts about the JSON serialization.  If they’re using the JSON serialization, then yes, combining them would be more friendly for those developers.

As I’d said in a private thread with Richard, I’m fine with the working group deciding either to combine or not combine them.  But given that the different choices make things easier/harder for different sets of developers, I believe that any decision to combine them should be well-discussed by the working group first, and not just done on a whim.

                                                            -- Mike

From: Hannes Tschofenig [mailto:[e-mail]]
Sent: Wednesday, February 06, 2013 12:27 PM
To: Mike Jones
Cc: Richard Barnes; [e-mail]
Subject: Re: [jose] A modest proposal for JSON-izing JW*

Why don't we address the issue right away (as Richard proposed) instead of postponing it to yet another draft?

Hannes

Sent from my ASUS Pad

Mike Jones <[e-mail]<mailto:[e-mail]>> wrote:
I’ll note that these are nearly identical to the JSON Serialization encodings already specified in http://tools.ietf.org/html/draft-jones-jose-jws-json-serialization-04 and http://tools.ietf.org/html/draft-jones-jose-jwe-json-serialization-04, other than you’re precluding multiple recipients.  The syntax:

     {"recipients":[
       {"header":"<header 1 contents>",
        "signature":"<signature 1 contents>"},
       ...
       {"header":"<header N contents>",
        "signature":"<signature N contents>"}],
      "payload":"<payload contents>"
     }

really isn’t far from what you’re proposing below.  It just has an array of per-recipient header fields, since accommodating multiple recipients is also a working group goal.

Once the rechartering is done, we’ll have working group JSON serialization specifications.  It’s a separate question whether to combine the compact and JSON serializations into the same document or to leave them separate.  The revised charter will allow us to do either.

                                                            -- Mike

From: [e-mail]<mailto:[e-mail]> [mailto:[e-mail]] On Behalf Of Richard Barnes
Sent: Wednesday, February 06, 2013 11:29 AM
To: [e-mail]<mailto:[e-mail]>
Subject: [jose] A modest proposal for JSON-izing JW*

Dear JOSE,

tl;dr: Let's please add a simple JSON encoding to the base JW* specs.

I've been complaining for a while that the JW* documents aren't JSON, and that the JSON serialization documents are too complex (because of the integrity check issues).  So I thought it was about time that I made an actual proposal for encoding the base JOSE object as JSON objects.  The approach would be essentially the same as in the JSON serialization documents, except with a focus on single objects.

JWE and JWS objects currently have the following form

jws = header.data.signature
jwe = header.key.iv.ciphertext.mac

The JSON encoding of a JWE/JWS would just take each of these Base64-encoded pieces and assign them a name in a JSON structure.

jws = {
    "header": header,
    "data": data,
    "signature": signature
}

jwe = {
    "header": header,
    "key": key,
    "iv": iv,
    "data": ciphertext,
    "mac": mac
}

It seems to me that these encodings are simple enough that they could be handled in a short section, in parallel to what I would call the "text serialization" in the current documents.  So I would like to propose that they be added to the base JWE and JWS documents.

Thanks,
--Richard