[jose] How to "extend" signatures?

[Martin Boßlet <[e-mail]>]

Hi,

is it correct that there is no explicit canonicalization step needed
in order to get from a JSON object to a "JSON Text Object" that
constitutes the final "JWS payload"? The examples only talk about the
UTF-8 representation of JSON objects, but this is not canonical IIRC?

I'm asking because this would make "extending" signatures like it is
practiced in the CAdES or XAdES standards [e.g. 1] much harder. There,
you typically need to reserialize parts of / the entire
payload in order to compute digests that will be used in "extension
fields". While those extension fields could certainly be embedded in
the non-integrity-protected header part of the JWS JSON Serialization
format, I'm not sure how to reserialize a JSON object parsed from a
signed JSON Text Object in order to reliably produce the same JSON
Text object again. This is not a problem with ASN.1 or XML because
ASN.1 DER (unlike BER) encoding is canonical by default, and the XML
is canonicalized before any digests are computed.

In order to serialize a JWS again after having parsed its contents,
does this mean I will always have to drag the original JWS encoding
along? Or did I overlook something, and there is some canonicalization
procedure that would ensure that I arrive at the same encoding again
when reserializing a parsed JSON object?

Thanks a lot in advance,
Martin Boßlet

[1] http://www.etsi.org/deliver/etsi_ts%5C101900_101999%5C101903%5C01.04.02_60%5Cts_101903v010402p.pdf