Re: [jose] Common elements (was: Re: Should we keep or remove the JOSE JWS and JWE MIME types?)

["Manger, James H" <[e-mail]>]

> Editorially, if we do decide to add application/jose and application/jose+json MIME types, I would register them in draft-ietf-jose-json-web-signature, just like other registry content shared between JWS and JWE, such as the JSON Web Signature and Encryption Header Parameters Registry.

>> While we're at it, you could move over the header parameters that are shared between the two.  Namely all but "enc" and "zip".  ("epk", and "apu" should move to JWA.)

+1

>> And once you do that, it seems more and more like JWE is becoming the little brother to JWS, in which case we might as well combine them.

+0.5
We do need a *single* description of the basic structure of any JOSE object. Calling such a spec "JWS" is not ideal. With a sensible separation of the spec into sections on the basic structure, a section of signing, a section on MACing, a section on authenticated encryption, sections on key exchange... -- it wouldn't matter quite so much if, say, the encryption section was in a separate document as long as it didn't have to duplicate so much text the way JWE does.

> As you know from our private conversation about your review comments, while closely related, the key selection header parameter definitions are, by design, not identical between the JWS and JWE spec.  In JWS they refer to the key that is used to check the signature/MAC.  In JWE they refer to the key to which the JWE was encrypted.  Trying to coalesce them would only make the text unnecessarily muddier in both cases.

Coalescing the text would highlight the design flaw that the same field (eg "kid") in the same place (JOSE header) has different meanings (eg identifying a recipient key or identifying an originator key). It might help us fix that design flaw.

--
James Manger