Subject: [jose] Hurdles when Converting XML/XML DSig to JSON

From: Anders Rundgren <[email-masked]>
Date: Sun, 18 Aug 2013 11:00:53 +0200

Hi,
I have begun seriously thinking about converting the KeyGen2 protocol into JSON.
Unfortunately I'm not too pleased with the result if I follow the current JOSE specifications.
In particular the JWS signature scheme makes the end-result violate a fundamental quality its XML counterpart: readability.

If you have a few minutes to spare, feel free looking into my pathetic (?) efforts coming up with a workaround:
http://webpki.org/papers/PKI/converting-xmldsig-2-json.pdf

BTW, I noted one issue that could be of general applicability and that is the use of indirect (2-level) signatures in XML DSig, PDF and possible several other schemes as well.
Question: are limitations in cryptographic subsystems for combined hashing and signing huge amounts of data only a historical artifact these days?

FWIW, the workaround solution adopts this idea to not impose any signature-related restrictions on message size.

Cheers,
Anders
http://webpki.org/papers/keygen2/doc/keygen2schema.html

---

From: Anders Rundgren <[email-masked]>
Date: Tue, 20 Aug 2013 14:53:34 +0200

I just found out that names SHOULD be unique in proper JSON which
will force me to convert essentially everything into arrays.

I thought these issues were addressed years ago but I was wrong:
http://www.ietf.org/mail-archive/web/json/current/msg01178.html

The JSON folks are apparently still struggling with basics...

Anders