Re: [media-types] Thoughts on suffixes, single and multiple

[Esko Dijk <[e-mail]>]

Discussion continued on Github: https://github.com/anima-wg/anima-jws-voucher/issues/7#issuecomment-2049753674



In summary, "voucher" is indeed a single YANG-defined data model with multiple possible serializations and signature methods.

Using "voucher-jws+json" looks fine because the JWS voucher is actually always encoded in the JSON serialization, hence +json.

While the authors could have registered a new single suffix for JSON-serialized JOSE (e.g. +jose-json or +jwtjson or so) this was not done.

I guess because it's extra text and doesn't add much benefit to the core protocol operation where both parties already know the type, whatever its name.



And multiple suffixes wasn't "ready to use" yet.



Esko


From: Orie Steele <[e-mail]>
Sent: Thursday, April 11, 2024 17:55
To: Manu Sporny <[e-mail]>
Cc: Esko Dijk <[e-mail]>; IETF Media Types <[e-mail]>
Subject: Re: [media-types] Thoughts on suffixes, single and multiple

See the IANA registries:
jose
application/jose<https://www.iana.org/assignments/media-types/application/jose>
[RFC7515<https://www.iana.org/go/rfc7515>]
jose+json
application/jose+json<https://www.iana.org/assignments/media-types/application/jose+json>
[RFC7515<https://www.iana.org/go/rfc7515>]
and:
cose
application/cose<https://www.iana.org/assignments/media-types/application/cose>
[RFC9052<https://www.iana.org/go/rfc9052>]
Note that there is no "cose+cbor", because cose is CBOR.
Whereas "jose" is the compact representation that uses base64url and "."

Regards,

OS

On Thu, Apr 11, 2024 at 8:52 AM Manu Sporny <[e-mail]<mailto:[e-mail]>> wrote:
On Tue, Apr 9, 2024 at 5:56 AM Esko Dijk <[e-mail]<mailto:[e-mail]>> wrote:
> Kind of like a digital bazaar of formats ;-)

*lol* I see what you did there. :)

> The media type is currently stated as "application/voucher-jws+json" - see first introduction paragraph.
> I'm assuming this is correct as the outer envelope appears to be JSON (Section 3.1 defines this).
> There was a long discussion about using "voucher+jws" or other names instead:
> https://github.com/anima-wg/anima-jws-voucher/issues/7

I've now read the entire thread, thanks for the pointer.

Yes, this highlights the current confusion around media type suffixes.

Using "+json" as the suffix when the syntax of the message is clearly
not JSON is just plain wrong.

Using "+jws" or "+jose" as the suffix if the syntax matches the "JWS
Syntax" is problematic because it doesn't specify if "JWS Compact
Serialization" or "JWS JSON Serialization" is used. If you're using
the former, the pattern seems to be to use "+jwt" (JOSE experts,
please correct me if there is more nuance to this). If you're using
the latter pattern, it's not clear what the suffix should be, though I
know "+json+jwt" has not received unanimous support previously, and
that might signal that the JOSE community needs to register another
suffix for "JWS JSON Serialization" form.

> The end goal of this work is to have one "Voucher" data model, that can be presented in both JSON and CBOR, and signed in multiple ways (e.g. CMS, COSE, JWT i.e. JOSE, ... )

Ah! This is interesting. That is the same model that the W3C
Verifiable Credentials WG has adopted, which triggered the whole
multiple suffixes discussion in that group. Are you saying that
"application/voucher" could be thought of as a meta model (there is a
set of information that you are encoding there), but the syntax isn't
determined until you serialize it to JSON or CBOR, and then it's not
secured until you use COSE, JWT, JOSE, etc?)

This is all useful information as it demonstrates that at least two
groups came to the same sort of design through completely independent
operation, and are now being hit by the "which suffix should we use?"
discussion. If I had to guess, you're probably exploring something
like the following:

* application/voucher+jwt
  * Base64 encoded JSON payload of voucher data model
* application/voucher+jose or application/voucher+jws
  * JWS JSON Serialization with base64-encoded JSON payload of voucher
data model
* application/voucher+cose
  * COSE CBOR serialization with ??deterministic?? CBOR payload of
voucher data model

What am I getting wrong wrt. the above?

-- manu

--
Manu Sporny - https://www.linkedin.com/in/manusporny/
Founder/CEO - Digital Bazaar, Inc.
https://www.digitalbazaar.com/

_______________________________________________
media-types mailing list
[e-mail]<mailto:[e-mail]>
https://www.ietf.org/mailman/listinfo/media-types


--



ORIE STEELE
Chief Technology Officer
www.transmute.industries<http://www.transmute.industries>

[https://ci3.googleusercontent.com/mail-sig/AIorK4xqtkj5psM1dDeDes_mjSsF3ylbEa5EMEQmnz3602cucAIhjLaHod-eVJq0E28BwrivrNSBMBc]<https://transmute.industries/>