Subject: [weirds] Non-repudiation and JOSE

From: "John Levine" <[email-masked]>
Date: 7 Nov 2012 16:10:38 -0000

I'm sitting in the JOSE working group session.  The stuff they're
doing is more complex than what I'd like, but if you want to sign a
block of JSON, they're defining how to do it.

I would NOT suggest adding non-repudiation to the WEIRDS work, but if
someone thinks it's important, go figure out JOSE and write an
draft that says what signatures to wrap around what answers.

Note that JOSE is not transparent.  If a client isn't expecting JOSE
signed data, it won't be able to find the payload even if it doesn't
care about the signature, so this would need extra query option to say
that the client wants a signed response.

-- 
Regards,
John Levine, [email-masked], Primary Perpetrator of "The Internet for Dummies",
Please consider the environment before reading this e-mail. http://jl.ly

---

From: "Hollenbeck, Scott" <[email-masked]>
Date: Wed, 7 Nov 2012 16:17:38 +0000

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On
> Behalf Of John Levine
> Sent: Wednesday, November 07, 2012 11:11 AM
> To: [email-masked]
> Subject: [weirds] Non-repudiation and JOSE
> 
> I'm sitting in the JOSE working group session.  The stuff they're doing
> is more complex than what I'd like, but if you want to sign a block of
> JSON, they're defining how to do it.

Definitely. I'm currently citing JOSE drafts in the security draft in the context of other security services, but if someone wants to provide non-repudiation with proof or origin or proof of delivery there's definitely work in progress to make it possible.

Scott