Subject: [Acme] JWS serialization

From: Logan Widick <[email-masked]>
Date: Tue, 14 Feb 2017 17:39:37 -0600

All,

Which JWS serialization is to be used when implementing? The document
indicates that the examples are in either flattened JSON or general
JSON serializations for readability. But which serialization must be
used for the actual implementations?

Sincerely,

Logan Widick

---

From: Jacob Hoffman-Andrews <[email-masked]>
Date: Tue, 14 Feb 2017 16:02:35 -0800

Flattened JSON, IMO. And I think we should standardize on that single
representation.

On 02/14/2017 03:39 PM, Logan Widick wrote:
> _______________________________________________
> Acme mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/acme
>

---

From: Fraser Tweedale <[email-masked]>
Date: Thu, 16 Feb 2017 12:38:02 +1000

> Flattened JSON, IMO. And I think we should standardize on that single
I think we should not specify only that a JSON serialisation be
used.  We SHOULD NOT specify that flattened must be used.  Many JOSE
libraries do not care and will decode either JSON representation as
long as it is valid.  Many JOSE libraries would not even provide a
knob to tell it to admit only the flattened serialisation (or vice
versa).

If the intent is to require that exactly one signature is used, then
just say that.

Thanks,
Fraser

---

From: Logan Widick <[email-masked]>
Date: Wed, 15 Feb 2017 23:04:12 -0600

So flattened and general JSON are both allowed, and the non-JSON compact is
not allowed?

---

From: Fraser Tweedale <[email-masked]>
Date: Thu, 16 Feb 2017 15:45:27 +1000

> So flattened and general JSON are both allowed, and the non-JSON compact is
Yes, I think excluding the compact serialisation is fine.  My
concern with distinguishing between "JSON" and "flattened JSON"
serialisations is that JOSE libraries might not allow you to control
what is produced, or restrict what is accepted.  (I am the author of
such a library).

Thanks,
Fraser