Subject: [jose] JSON Serializations for JWS and JWE

From: Mike Jones <[email-masked]>
Date: Mon, 5 Mar 2012 19:06:40 +0000

Members of the JOSE working group have described use cases where a JSON top-level representation of digitally signed, HMAC'ed, or encrypted content is desirable.  They have also described use cases where multiple digital signatures and/or HMACs need to applied to the same message and where the same plaintext needs to be encrypted to multiple recipients.

Responding to those use cases and working group input, I have created two new brief specifications:

*         JSON Web Signature JSON Serialization (JWS-JS)

*         JSON Web Encryption JSON Serialization (JWE-JS)
These use the same cryptographic operations as JWS and JWE, but serialize the results into a JSON objects, rather than a set of base64url encoded values separated by periods (as is done for JWS and JWE to produce compact, URL-safe representations).

These drafts are available at:

*         http://tools.ietf.org/html/draft-jones-json-web-signature-json-serialization-00

*         http://tools.ietf.org/html/draft-jones-json-web-encryption-json-serialization-00

HTML-formatted versions are available at:

*         http://self-issued.info/docs/draft-jones-json-web-signature-json-serialization-00.html

*         http://self-issued.info/docs/draft-jones-json-web-encryption-json-serialization-00.html

Feedback welcome!

                                                                -- Mike

P.S.  Since I'm sure working group members will ask, this version of JSE-JS doesn't add integrity for non-AEAD operations.  I plan to publish a new JWE draft that does so in the next week and will update JWE-JS to also incorporate this functionality at the same time.