Re: [KEYPROV] Giving up on XML DSig => JSON

Anders Rundgren <anders.rundgren@telia.com> Thu, 29 August 2013 09:54 UTC

Return-Path: <anders.rundgren@telia.com>
X-Original-To: keyprov@ietfa.amsl.com
Delivered-To: keyprov@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9AF9921F856A for <keyprov@ietfa.amsl.com>; Thu, 29 Aug 2013 02:54:45 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.391
X-Spam-Level:
X-Spam-Status: No, score=-2.391 tagged_above=-999 required=5 tests=[AWL=0.208, BAYES_00=-2.599]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id G1dHkE2F4oQX for <keyprov@ietfa.amsl.com>; Thu, 29 Aug 2013 02:54:45 -0700 (PDT)
Received: from smtp-out11.han.skanova.net (smtp-out11.han.skanova.net [195.67.226.200]) by ietfa.amsl.com (Postfix) with ESMTP id 26FFD21F9E9F for <keyprov@ietf.org>; Thu, 29 Aug 2013 02:54:45 -0700 (PDT)
Received: from [192.168.0.5] (37.250.134.95) by smtp-out11.han.skanova.net (8.5.133) (authenticated as u36408181) id 521DA8680008DCF3; Thu, 29 Aug 2013 11:54:35 +0200
Message-ID: <521F1A4D.9090502@telia.com>
Date: Thu, 29 Aug 2013 11:54:21 +0200
From: Anders Rundgren <anders.rundgren@telia.com>
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:17.0) Gecko/20130801 Thunderbird/17.0.8
MIME-Version: 1.0
To: Simon Josefsson <simon@josefsson.org>
References: <521EEFEE.9080302@telia.com> <20130829103542.7e22fea3@latte.josefsson.org>
In-Reply-To: <20130829103542.7e22fea3@latte.josefsson.org>
X-Enigmail-Version: 1.5.2
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Cc: keyprov@ietf.org
Subject: Re: [KEYPROV] Giving up on XML DSig => JSON
X-BeenThere: keyprov@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: "Provisioning of Symmetric Keys \(keyprov\)" <keyprov.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/keyprov>, <mailto:keyprov-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/keyprov>
List-Post: <mailto:keyprov@ietf.org>
List-Help: <mailto:keyprov-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/keyprov>, <mailto:keyprov-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 29 Aug 2013 09:54:45 -0000

On 2013-08-29 10:35, Simon Josefsson wrote:
> You wrote:
> 
>> Since Google doesn't support XSD or XML DSig in Android I began
>> looking at other alternatives. There were none :-( Now there is :-)
>>
>> https://openkeystore.googlecode.com/svn/resources/trunk/docs/Enveloped-JSON-Signatures.pdf
> 
> Did you implement JWS or something else?

I did not use JWS.

> If the latter, why not JWS?

Because JWS is based on in-line signatures of base64-encoded payloads.
This would ruin the readability of the already complex KeyGen2 protocol
and make the switch from XML look bad.

> It seems to be where everyone in the JSON-world is headed.
> 
> http://tools.ietf.org/html/draft-jones-json-web-signature-04

Yes, but these guys only work with comparatively simple authorization systems
like OAuth and OpenID.

In addition, KeyGen2 uses a bunch of non-standard constructs including
SM (Secure Messaging) so having a proprietary signature mechanism seems
like a minor problem.

Cheers,
Anders

> 
> /Simon
>