Re: [KEYPROV] Giving up on XML DSig => JSON

[Anders Rundgren <[e-mail]>]

On 2013-08-29 10:35, Simon Josefsson wrote:
> You wrote:
> 
>> Since Google doesn't support XSD or XML DSig in Android I began
>> looking at other alternatives. There were none :-( Now there is :-)
>>
>> https://openkeystore.googlecode.com/svn/resources/trunk/docs/Enveloped-JSON-Signatures.pdf
> 
> Did you implement JWS or something else?

I did not use JWS.

> If the latter, why not JWS?

Because JWS is based on in-line signatures of base64-encoded payloads.
This would ruin the readability of the already complex KeyGen2 protocol
and make the switch from XML look bad.

> It seems to be where everyone in the JSON-world is headed.
> 
> http://tools.ietf.org/html/draft-jones-json-web-signature-04

Yes, but these guys only work with comparatively simple authorization systems
like OAuth and OpenID.

In addition, KeyGen2 uses a bunch of non-standard constructs including
SM (Secure Messaging) so having a proprietary signature mechanism seems
like a minor problem.

Cheers,
Anders

> 
> /Simon
>