Subject: [Anima] [Cbor] FYI: JSON Constrained Notation (fwd) Peter Saint-Andre - Filament: [Cbor] FYI: JSON Constrained Notation

From: Michael Richardson <[email-masked]>
Date: Thu, 18 May 2017 14:27:25 -0400

So, this proposes to use CBOR to "compress" JSON, preserving JWT/JOSE
signatures, rather than using CWT.  I'm not sure what I think of this as yet.

Subject: [Cbor] FYI: JSON Constrained Notation
From: Peter Saint-Andre - Filament <[email-masked]>
To: [email-masked], [email-masked], [email-masked], [email-masked]
Cc: Jeremie Miller <[email-masked]>
Date: Thu, 18 May 2017 10:50:33 -0600
List-Id: "Concise Binary Object Representation \(CBOR\)" <cbor.ietf.org>

[Cross-posted to ACE, CBOR, JOSE, JSON because it might be of interest
to folks on all four lists.]

Folks here might have an interest in an I-D that Jeremie Miller and I
just submitted, defining a set of mapping rules from JSON to CBOR that
preserves all semantic information. The intent is to use the JOSE
standards (and related work such as OpenID Connect) unmodified in
constrained environments.

https://tools.ietf.org/html/draft-miller-json-constrained-notation-00

For now, please send feedback directly to the authors.

Thanks!

Peter

--
Peter Saint-Andre
https://filament.com/

_______________________________________________
CBOR mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/cbor

--
Michael Richardson <[email-masked]>, Sandelman Software Works
 -= IPv6 IoT consulting =-

---

From: Carsten Bormann <[email-masked]>
Date: Thu, 18 May 2017 21:02:19 +0200

> On May 18, 2017, at 20:27, Michael Richardson <[email-masked]> wrote:
> 
> 

My summary: JSCN is great if you actually *have* to process JOSE-signed/-encrypted material (such as JWTs) on a device on a constrained network.  JSCN is more compact than pure JOSE.  It does, however, carry all the complexity that JSON brings with it down to the device: You need to reconstruct actual JSON to generate the signing inputs.

If the source of the protected material can be made constrained-aware, COSE and CWTs are the better choice.  One of the objectives of the two-tier architecture of constrained/less-constrained devices is to keep as much of the business logic and complexity up in the less-constrained devices, which then provide simple, unambiguous instructions to the constrained devices.  But even if you don’t have that architecture, in a new protocol you can avoid the complexity that would limit coverage of low-resource, low-energy devices.

Grüße, Carsten

---

From: Michael Richardson <[email-masked]>
Date: Fri, 19 May 2017 13:43:16 -0400

> My summary: JSCN is great if you actually *have* to process
    > JOSE-signed/-encrypted material (such as JWTs) on a device on a
    > constrained network.  JSCN is more compact than pure JOSE.  It does,
    > however, carry all the complexity that JSON brings with it down to the
    > device: You need to reconstruct actual JSON to generate the signing
    > inputs.

Agreed.

    > If the source of the protected material can be made constrained-aware,
    > COSE and CWTs are the better choice.  One of the objectives of the
    > two-tier architecture of constrained/less-constrained devices is to
    > keep as much of the business logic and complexity up in the
    > less-constrained devices, which then provide simple, unambiguous
    > instructions to the constrained devices.  But even if you don’t have
    > that architecture, in a new protocol you can avoid the complexity that
    > would limit coverage of low-resource, low-energy devices.

I agree. I see it easier to teach non-constrained devices new tricks.
I'm not convinced we can use any of the deployed JOSE infrastructure
*completely* unchanged, so as long as changes are needed...