Subject: [jose] W3C project proposal using stacked signatures

From: Anders Rundgren <[email-masked]>
Date: Thu, 26 Nov 2015 17:58:30 +0100

Disclaimer: I have not been involved in this in any way...
https://www.w3.org/Payments/IG/wiki/Main_Page/ProposalsQ42015/SCAI

Anyway, since the purpose is creating a single object eventually holding all contributions (like a multi-step block-chain), a scheme where signatures effectively hide the content doesn't appear to be the right solution.  Incompatibility with JSON schema and bigger size [1] compared to clear-text solutions may also prove to be a hurdle for JOSE for business messaging.

Personally I think it would be better creating a JOSE2 where the existing JOSE signature algorithms and [most of the] key-words are applied to an ES6-compatible [2] "in-object" JS/JSON signature solution.

- Anders

1] in a scheme using the depicted 6 envelopes the difference may easily be a factor 2.5 or more.

2] As implemented in Chrome, Firefox, and Safari.

---

From: Melinda Shore <[email-masked]>
Date: Thu, 26 Nov 2015 09:42:01 -0900

> https://www.w3.org/Payments/IG/wiki/Main_Page/ProposalsQ42015/SCAI

FWIW this was in the Payments Interest Group and not the
Payments Working Group, and it's not clear to me that
they're actually going to do anything with this.  I would
double-check with them about what's going on with that.

I agree with you about the proposal being unattractive.

Melinda

---

From: Anders Rundgren <[email-masked]>
Date: Thu, 26 Nov 2015 21:27:50 +0100

> double-check with them about what's going on with that.

You are absolutely correct, this is one of huge bunch of proposals:
https://lists.w3.org/Archives/Public/public-webpayments-ig/2015Nov/0074.html

> I agree with you about the proposal being unattractive.

The intention with my message was rather highlighting the mismatch between JOSE
and schemes like the one proposed which (IMO) motivates a renewed JOSE activity
along the lines I have previously described.

After the recent revelations about ES6 and its implementation in some very popular
platforms this seems to be even more useful than I originally thought.  None of
that information and use-cases were at hand when JOSE started.

Anders

>
> Melinda
>
> _______________________________________________
> jose mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/jose
>