Subject: [jose] Use JSON array for JWS/JWE x5c parameter?

From: "Vladimir Dzhuvinov / NimbusDS" <[email-masked]>
Date: Thu, 20 Sep 2012 08:54:07 -0700

Hi guys,

If I understand correctly, the JWS and JWE specs say that the "x5c"
parameter is a JSON string:

http://tools.ietf.org/html/draft-ietf-jose-json-web-signature-05#section-4.1.6

The example:

http://tools.ietf.org/html/draft-ietf-jose-json-web-signature-05#appendix-B

Wouldn't be more sensible to use a JSON array to represent the chain of
X.509 certs? Instead of a string of concatenated B64 data with
"-----BEGIN CERTIFICATE-----" and "-----END CERTIFICATE-----"
delimiters?

My case for using a JSON array:

1. A single parse of the header will do the chain as well - saves an
extra non-JSON parse operation to split the x5c into chunks.

2. Saves space.

3. Makes better use of the existing JSON header structure.

I suppose the current format was influenced by how X.509 chains are
typically exported by programs for file transfer/storage. However, in
the case of JWS/JWE, the x5c parameter will be created programmatically
and there a JSON array fits better.

What do you guys think?

Cheers,

Vladimir

--
Vladimir Dzhuvinov : www.NimbusDS.com : [email-masked]

---

From: Mike Jones <[email-masked]>
Date: Thu, 20 Sep 2012 18:45:14 +0000

This seems like a reasonable change to me and the rationale stated below makes sense.  What do others think?

				-- Mike

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Vladimir Dzhuvinov / NimbusDS
Sent: Thursday, September 20, 2012 8:54 AM
To: [email-masked]
Subject: [jose] Use JSON array for JWS/JWE x5c parameter?

Hi guys,

The example:

Wouldn't be more sensible to use a JSON array to represent the chain of
X.509 certs? Instead of a string of concatenated B64 data with "-----BEGIN CERTIFICATE-----" and "-----END CERTIFICATE-----"
delimiters?

1. A single parse of the header will do the chain as well - saves an extra non-JSON parse operation to split the x5c into chunks.

2. Saves space.

I suppose the current format was influenced by how X.509 chains are typically exported by programs for file transfer/storage. However, in the case of JWS/JWE, the x5c parameter will be created programmatically and there a JSON array fits better.

What do you guys think?

Cheers,

Vladimir

--
Vladimir Dzhuvinov : www.NimbusDS.com : [email-masked] _______________________________________________
jose mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/jose

---

From: John Bradley <[email-masked]>
Date: Thu, 20 Sep 2012 15:49:26 -0300

I am OK with that being an array.  The concatenated PEM has always seemed nasty convention to me.

John B.
On 2012-09-20, at 3:45 PM, Mike Jones <[email-masked]> wrote:

> _______________________________________________
> jose mailing list
> [email-masked]

---

From: "Matt Miller (mamille2)" <[email-masked]>
Date: Thu, 20 Sep 2012 19:30:00 +0000

That works for me.

- m&m

Matt Miller - <[email-masked]>
Cisco Systems, Inc.

---

From: Richard Barnes <[email-masked]>
Date: Thu, 20 Sep 2012 21:31:32 -0400

+1

Two quick comments:

1. As long as we're using an ordered type, it might be nice to require that the chain be in order, as in TLS.

2. Since PEM is just base64-encoded DER, we should just specify that each element in the array is base64url-encoded DER (assuming that that's the base64 variant we're using).

---

From: Mike Jones <[email-masked]>
Date: Fri, 21 Sep 2012 01:33:08 +0000

Order is already required and this would be maintained.  Your point 2 is I think what Vladimir had in mind as well.

				-- Mike

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Richard Barnes
Sent: Thursday, September 20, 2012 6:32 PM
To: Matt Miller
Cc: <[email-masked]>; Vladimir Dzhuvinov / NimbusDS
Subject: Re: [jose] Use JSON array for JWS/JWE x5c parameter?

+1

Two quick comments:

On Sep 20, 2012, at 3:30 PM, Matt Miller (mamille2) wrote:

>> the case of JWS/JWE, the x5c parameter will be created 
>> programmatically and there a JSON array fits better.
>> 
>> What do you guys think?
>> 
>> Cheers,
>> 
>> Vladimir
>> 
>> --