Subject: [jose] Java libraries supporting JWS/JWE JSON serialization

From: Prabath Siriwardena <[email-masked]>
Date: Sat, 7 Jun 2014 00:23:33 +0530

Are there any Java libraries supporting JWS/JWE JSON serialization?

I could not find a way with nimbus-jose-jwt...

Appreciate a lot any pointers...

Thanks & Regards,
Prabath

Twitter : @prabath
LinkedIn : http://www.linkedin.com/in/prabathsiriwardena

Mobile : +94 71 809 6732

http://blog.facilelogin.com
http://blog.api-security.org

---

From: Mike Jones <[email-masked]>
Date: Fri, 6 Jun 2014 19:32:54 +0000

By design, as long as you’re not using features not supported by the Compact Serialization, such as unprotected header fields, it’s simply a syntactic transformation to go between the two serializations (replacing dot-separated fields with the same field values in JSON structures).  This is even true if you have multiple signatures over the same content or content encrypted to multiple recipients.

                                                            -- Mike

From: jose [mailto:[email-masked]] On Behalf Of Prabath Siriwardena
Sent: Friday, June 06, 2014 11:54 AM
To: [email-masked]
Subject: [jose] Java libraries supporting JWS/JWE JSON serialization

Thanks & Regards,
Prabath

Twitter : @prabath

Mobile : +94 71 809 6732

---

From: Prabath Siriwardena <[email-masked]>
Date: Sat, 7 Jun 2014 01:12:41 +0530

Thanks Mike for the explanation.. In my case I am working with a JWT header
having both protected and unprotected headers...

Thanks & regards,
-Prabath

On Sat, Jun 7, 2014 at 1:02 AM, Mike Jones <[email-masked]>
wrote:

>  By design, as long as you’re not using features not supported by the
> Compact Serialization, such as unprotected header fields, it’s simply a
> syntactic transformation to go between the two serializations (replacing
> dot-separated fields with the same field values in JSON structures).  This
> is even true if you have multiple signatures over the same content or
> content encrypted to multiple recipients.
>
>
>
>                                                             -- Mike
>
>
>
> *From:* jose [mailto:[email-masked]] *On Behalf Of *Prabath
> Siriwardena
> *Sent:* Friday, June 06, 2014 11:54 AM
> *To:* [email-masked]
> *Subject:* [jose] Java libraries supporting JWS/JWE JSON serialization
>
>
>

-- 
Thanks & Regards,
Prabath

Twitter : @prabath

Mobile : +94 71 809 6732

---

From: Mike Jones <[email-masked]>
Date: Fri, 6 Jun 2014 19:46:21 +0000

JWTs only use the compact serialization.  The last sentence of http://tools.ietf.org/html/draft-ietf-oauth-json-web-token-19#section-1 reads:
   JWTs are always represented using the JWS Compact
   Serialization or the JWE Compact Serialization.

So if your data structure is actually a JWT, the JSON Serialization isn’t relevant.  If it’s not a JWT, which serialization you choose is application-specific.

                                                            -- Mike

From: Prabath Siriwardena [mailto:[email-masked]]
Sent: Friday, June 06, 2014 12:43 PM
To: Mike Jones
Cc: [email-masked]
Subject: Re: [jose] Java libraries supporting JWS/JWE JSON serialization

Thanks Mike for the explanation.. In my case I am working with a JWT header having both protected and unprotected headers...

Thanks & regards,
-Prabath

On Sat, Jun 7, 2014 at 1:02 AM, Mike Jones <[email-masked]<mailto:[email-masked]>> wrote:
By design, as long as you’re not using features not supported by the Compact Serialization, such as unprotected header fields, it’s simply a syntactic transformation to go between the two serializations (replacing dot-separated fields with the same field values in JSON structures).  This is even true if you have multiple signatures over the same content or content encrypted to multiple recipients.

                                                            -- Mike

From: jose [mailto:[email-masked]<mailto:[email-masked]>] On Behalf Of Prabath Siriwardena
Sent: Friday, June 06, 2014 11:54 AM
To: [email-masked]<mailto:[email-masked]>
Subject: [jose] Java libraries supporting JWS/JWE JSON serialization

Thanks & Regards,
Prabath

Twitter : @prabath

Mobile : +94 71 809 6732<tel:%2B94%2071%20809%206732>

--
Thanks & Regards,
Prabath

Twitter : @prabath

Mobile : +94 71 809 6732

---

From: Prabath Siriwardena <[email-masked]>
Date: Sat, 7 Jun 2014 01:33:14 +0530

Thanks for the correction.. Let me rephrase.. I am in fact trying out JWS
JSON serialization with JWS Header (with protected and unprotected) + JWS
payload.. This is for a sample purpose and looking for a Java library to
achieve this...

Thanks & regards,
-Prabath

On Sat, Jun 7, 2014 at 1:16 AM, Mike Jones <[email-masked]>
wrote:

>  JWTs only use the compact serialization.  The last sentence of
> http://tools.ietf.org/html/draft-ietf-oauth-json-web-token-19#section-1
> reads:
>
> So if your data structure is actually a JWT, the JSON Serialization isn’t
> relevant.  If it’s not a JWT, which serialization you choose is
> application-specific.
>
>
>
>                                                             -- Mike
>
>
>
> *From:* Prabath Siriwardena [mailto:[email-masked]]
> *Sent:* Friday, June 06, 2014 12:43 PM
> *To:* Mike Jones
> *Cc:* [email-masked]
> *Subject:* Re: [jose] Java libraries supporting JWS/JWE JSON serialization
>
>
>
> Thanks Mike for the explanation.. In my case I am working with a JWT
> header having both protected and unprotected headers...
>
>
>
> Thanks & regards,
>
> -Prabath
>
>
>

-- 
Thanks & Regards,
Prabath

Twitter : @prabath

Mobile : +94 71 809 6732