Re: [media-types] Thoughts on suffixes, single and multiple

[Orie Steele <[e-mail]>]

See the IANA registries:
jose application/jose
<https://www.iana.org/assignments/media-types/application/jose> [RFC7515
<https://www.iana.org/go/rfc7515>]
jose+json application/jose+json
<https://www.iana.org/assignments/media-types/application/jose+json> [
RFC7515 <https://www.iana.org/go/rfc7515>]and:
cose application/cose
<https://www.iana.org/assignments/media-types/application/cose> [RFC9052
<https://www.iana.org/go/rfc9052>]
Note that there is no "cose+cbor", because cose is CBOR.
Whereas "jose" is the compact representation that uses base64url and "."

Regards,

OS

On Thu, Apr 11, 2024 at 8:52 AM Manu Sporny <[e-mail]>
wrote:

> On Tue, Apr 9, 2024 at 5:56 AM Esko Dijk <[e-mail]>
> wrote:
> > Kind of like a digital bazaar of formats ;-)
>
> *lol* I see what you did there. :)
>
> > The media type is currently stated as "application/voucher-jws+json" -
> see first introduction paragraph.
> > I'm assuming this is correct as the outer envelope appears to be JSON
> (Section 3.1 defines this).
> > There was a long discussion about using "voucher+jws" or other names
> instead:
> > https://github.com/anima-wg/anima-jws-voucher/issues/7
>
> I've now read the entire thread, thanks for the pointer.
>
> Yes, this highlights the current confusion around media type suffixes.
>
> Using "+json" as the suffix when the syntax of the message is clearly
> not JSON is just plain wrong.
>
> Using "+jws" or "+jose" as the suffix if the syntax matches the "JWS
> Syntax" is problematic because it doesn't specify if "JWS Compact
> Serialization" or "JWS JSON Serialization" is used. If you're using
> the former, the pattern seems to be to use "+jwt" (JOSE experts,
> please correct me if there is more nuance to this). If you're using
> the latter pattern, it's not clear what the suffix should be, though I
> know "+json+jwt" has not received unanimous support previously, and
> that might signal that the JOSE community needs to register another
> suffix for "JWS JSON Serialization" form.
>
> > The end goal of this work is to have one "Voucher" data model, that can
> be presented in both JSON and CBOR, and signed in multiple ways (e.g. CMS,
> COSE, JWT i.e. JOSE, ... )
>
> Ah! This is interesting. That is the same model that the W3C
> Verifiable Credentials WG has adopted, which triggered the whole
> multiple suffixes discussion in that group. Are you saying that
> "application/voucher" could be thought of as a meta model (there is a
> set of information that you are encoding there), but the syntax isn't
> determined until you serialize it to JSON or CBOR, and then it's not
> secured until you use COSE, JWT, JOSE, etc?)
>
> This is all useful information as it demonstrates that at least two
> groups came to the same sort of design through completely independent
> operation, and are now being hit by the "which suffix should we use?"
> discussion. If I had to guess, you're probably exploring something
> like the following:
>
> * application/voucher+jwt
>   * Base64 encoded JSON payload of voucher data model
> * application/voucher+jose or application/voucher+jws
>   * JWS JSON Serialization with base64-encoded JSON payload of voucher
> data model
> * application/voucher+cose
>   * COSE CBOR serialization with ??deterministic?? CBOR payload of
> voucher data model
>
> What am I getting wrong wrt. the above?
>
> -- manu
>
> --
> Manu Sporny - https://www.linkedin.com/in/manusporny/
> Founder/CEO - Digital Bazaar, Inc.
> https://www.digitalbazaar.com/
>
> _______________________________________________
> media-types mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/media-types
>


-- 


ORIE STEELE
Chief Technology Officer
www.transmute.industries

<https://transmute.industries>