Re: [media-types] Thoughts on suffixes, single and multiple

[Manu Sporny <[e-mail]>]

On Tue, Apr 9, 2024 at 5:56 AM Esko Dijk <[e-mail]> wrote:
> Kind of like a digital bazaar of formats ;-)

*lol* I see what you did there. :)

> The media type is currently stated as "application/voucher-jws+json" - see first introduction paragraph.
> I'm assuming this is correct as the outer envelope appears to be JSON (Section 3.1 defines this).
> There was a long discussion about using "voucher+jws" or other names instead:
> https://github.com/anima-wg/anima-jws-voucher/issues/7

I've now read the entire thread, thanks for the pointer.

Yes, this highlights the current confusion around media type suffixes.

Using "+json" as the suffix when the syntax of the message is clearly
not JSON is just plain wrong.

Using "+jws" or "+jose" as the suffix if the syntax matches the "JWS
Syntax" is problematic because it doesn't specify if "JWS Compact
Serialization" or "JWS JSON Serialization" is used. If you're using
the former, the pattern seems to be to use "+jwt" (JOSE experts,
please correct me if there is more nuance to this). If you're using
the latter pattern, it's not clear what the suffix should be, though I
know "+json+jwt" has not received unanimous support previously, and
that might signal that the JOSE community needs to register another
suffix for "JWS JSON Serialization" form.

> The end goal of this work is to have one "Voucher" data model, that can be presented in both JSON and CBOR, and signed in multiple ways (e.g. CMS, COSE, JWT i.e. JOSE, ... )

Ah! This is interesting. That is the same model that the W3C
Verifiable Credentials WG has adopted, which triggered the whole
multiple suffixes discussion in that group. Are you saying that
"application/voucher" could be thought of as a meta model (there is a
set of information that you are encoding there), but the syntax isn't
determined until you serialize it to JSON or CBOR, and then it's not
secured until you use COSE, JWT, JOSE, etc?)

This is all useful information as it demonstrates that at least two
groups came to the same sort of design through completely independent
operation, and are now being hit by the "which suffix should we use?"
discussion. If I had to guess, you're probably exploring something
like the following:

* application/voucher+jwt
  * Base64 encoded JSON payload of voucher data model
* application/voucher+jose or application/voucher+jws
  * JWS JSON Serialization with base64-encoded JSON payload of voucher
data model
* application/voucher+cose
  * COSE CBOR serialization with ??deterministic?? CBOR payload of
voucher data model

What am I getting wrong wrt. the above?

-- manu

-- 
Manu Sporny - https://www.linkedin.com/in/manusporny/
Founder/CEO - Digital Bazaar, Inc.
https://www.digitalbazaar.com/