Subject: Re: [jose] Comments on the JSON Web Encryption document

From: Mike Jones <[email-masked]>
Date: Fri, 10 Feb 2012 22:39:46 +0000

Like my previous reply about the JWS spec, this note replies the comments from your note where the resolutions to them were incomplete or different than you proposed.  It also doesn't reply to comments whose resolutions are already incorporated into the working group drafts.

                                                                -- Mike

2. The example in section 3 makes me interested in the following question.

When I do a ToString on a binary value in JSON, what is the output.  Is this going to be better than using the base64 encoding of binary values to get text values followed by doing the base64 encoding again.

The answer to the ToString question is obviously going to be language and environment specific.  Do you mean in JavaScript?  C#?  Java?  Ruby? ...  The reason for using base64url is that it has the right semantic properties and is language/environment independent.

3. Given the amount of overlap.  Is there a reason for having different IANA registries for the encryption and signature header parameter names?

I agree that these should probably be combined, especially as the come from an overlapping parameter space.  I'll put this on my to-do list.   Any disagreement?

4.  Is there a reason for not supporting the "zip" header for signature?

Interestingly, there's currently a discussion of this very topic on the JOSE list.  (See the thread "Would it be possible to add DEFLATE compression for the JWT payload into the JWT/JWS/JWE specs?")  It wasn't there thus far because every mandatory-to-implement feature makes implementations that much harder to do and simplicity is a core goal.  That being said, if the WG has a clear and compelling need for this that outweighs the complexity downside, it could of course be added.  Discussion?