Subject: [Cacao] GAP Analysis - JOSE

From: Bret Jordan <[email-masked]>
Date: Wed, 10 Oct 2018 15:43:19 -0600

All,

One of the requirements that we have in CACAO is the ability to sign various parts of the JSON structure at different levels and by different organizations.  I have reviewed RFC 7515 and I am not sure that it will actually work for what we need.  I did reach out to the JOSE WG and one of the members responded with that JWS does not work in JSON but rather a byte stream, and it does not define a canonical JSON serialization. So this will be a problem based on what we need to do. However, I did find this work: https://cyberphone.github.io/doc/security/jcs.html <https://cyberphone.github.io/doc/security/jcs.html> that might help us. 

I have asked the JOSE working group if they would be willing to do some more work to define a way to do something like the link above. Hopefully they will be receptive to that.  If not we may have to beg another working group / study group/ technical committee to do some work on JSON signatures. 

We will be talking more about the requirements and specifically the digital signature requirements in our hosted WebEx on the 24th.  If you have not yet registered for that WebEx, and you are interested in this work, please do so.

Thanks,
Bret
PGP Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 0050
"Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg."