Subject: [jose] Suggestion for new term: JSON Web Object (JWO) or JSON Web Message (JWM)

From: "Vladimir Dzhuvinov / NimbusDS" <[email-masked]>
Date: Thu, 31 May 2012 04:44:10 -0700

Hi guys,

Yesterday, during work on the Nimbus-JWT library, we realised the need
to come up with a common term for the _things_ that are encoded by
alg:none, JWS and JWE, whether they serialise to the compact or the JS
form.

After a bit of brain storming two favourites emerged:

JSON Web Object (JWO)

and 

JSON Web Message (JWM).

JSON Web Object is more general. It may however cause confusion, due to
its "JSON object" connotation, as the packaged content isn't always
JSON, it can be arbitrary.

JSON Web Message doesn't have this potential confusion, and it also
implies content that is carried in a specific form.

Another candidate was JSON Web Serialization. It's weaknesses are that
it is not a clean noun and its abbreviation conflicts with the
established JWS term.

I think it makes sense to define such a common term. It's difficult to
have a conversation on JOSE without one. If a specific term is not
defined, people will sooner or later come up with one. We, for instance,
will have to give this base class a name, from which plain, JWS and JWE
subclass.

Vladimir

--
Vladimir Dzhuvinov : www.NimbusDS.com : [email-masked]

---

From: "Manger, James H" <[email-masked]>
Date: Thu, 31 May 2012 23:25:48 +1000

> alg:none, JWS and JWE, whether they serialise to the compact or the JS

I agree.

> After a bit of brain storming two favourites emerged:

JWO and JWM are both missing the security angle, which is the primary reason for JOSE.

How about "JWsec", and I would call the spec "JSON Web Message Security Format".

I don't think we will need separate acronyms for specific modes once we have a nickname for the top-level structure. For instance, say "signed JWsec" and "encrypted JWsec", instead of JWS and JWE.
(Or are "authentic JWsec" and "confidential JWsec" better phrases?)

--
James Manger