Subject: [jose] Jws Json Unencoded option and JSON payloads

From: Sergey Beryozkin <[email-masked]>
Date: Tue, 24 May 2016 15:28:37 +0100

Hi

I've been experimenting recently with JWS JSON and
https://tools.ietf.org/html/rfc7797

I did some tests awhile back with the plain text payload, all was good, 
but now I've tried passing an encoded JSON, example, {"a":"b"} which 
resulted in

{
   "payload": "{"a":"b"}"
   ...
}

which caused a parse error on the receiving side. I found

https://tools.ietf.org/html/rfc7797#section-8

referring to the fact it is the responsibility of the application to 
deal with it.

My question is, why, when "b64":false is set, it is not possible to have

{
"payload": {"a":"b"}
...
}

for payloads which are in JSON format as opposed to having a restriction 
the JWS JSON payload should always be a JSON string ?

Thanks, Sergey

---

From: Sergey Beryozkin <[email-masked]>
Date: Thu, 26 May 2016 10:30:28 +0100

Hi All

Are there any interoperability events scheduled in the near future where 
the various implementations can be tested ?

Thanks, Sergey

---

From: Mike Jones <[email-masked]>
Date: Thu, 26 May 2016 15:58:10 +0000

I'm not aware of any interop events but there are some great resources available to test interoperability.  http://tools.ietf.org/html/rfc7520 contains test cases for all the JWA algorithms.  If you can interop with all those test cases, I'm sure your implementation will be in great shape.

The https://jwt.io/ site lets you do live verification of JWTs of any kind.

Finally, the http://openid.net/developers/libraries/#jwt contains a list of many implementations you could test against.

				Best wishes,
				-- Mike

-----Original Message-----
From: jose [mailto:[email-masked]] On Behalf Of Sergey Beryozkin
Sent: Thursday, May 26, 2016 2:30 AM
To: [email-masked]
Subject: [jose] JOSE implementation Interoperability events

Hi All

Are there any interoperability events scheduled in the near future where the various implementations can be tested ?

Thanks, Sergey

_______________________________________________
jose mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/jose

---

From: "Jim Schaad" <[email-masked]>
Date: Thu, 26 May 2016 09:14:26 -0700

Are people interested in doing anything along these lines at the next IETF
meeting as part of the hackathon?  If so then I can set it up.

Jim

> Are there any interoperability events scheduled in the near future where
the
> various implementations can be tested ?
> 
> Thanks, Sergey
>

---

From: Anders Rundgren <[email-masked]>
Date: Thu, 26 May 2016 18:31:14 +0200

> meeting as part of the hackathon?  If so then I can set it up.

What kind of interoperability testing are you looking for?
I'm sure just about every JSON parser out there manages parsing legitimate JSON data.

What has recently been identified as "differing" (not necessarily the same as
non-conformant), are things like case sensitivity (missing in GO), quite
different ways of serializing floating point numbers (Python), and of course
my personal favorite; the ability honoring property order during parsing
and serialization where the ES6 folks took the lead (albeit with a little
twist for fully numeric property names).

Anders

---

From: Carsten Bormann <[email-masked]>
Date: Thu, 26 May 2016 18:22:32 +0200

Jim Schaad wrote:
> meeting as part of the hackathon?  

Yes, please.  Maybe we can add COSE to the mix.
(Unfortunately, on Saturday most "constrained" people will be at the
RIOT summit, but there also is Sunday, except for those that are at the
6lo plugtest.  That weekend is getting a bit crowded.)

Grüße, Carsten

---

From: Sergey Beryozkin <[email-masked]>
Date: Thu, 26 May 2016 17:34:52 +0100

Hi Mike

Thanks for the information,

> I'm not aware of any interop events but there are some great resources available to test interoperability.  http://tools.ietf.org/html/rfc7520 contains test cases for all the JWA algorithms.  If yo…

I believe we have all those JWS examples tested (tests contributed), but 
a JIRA issue exists to complete the JWE examples section - I believe in 
some cases the sequences won't match but for some algorithms will, we 
will check.
> The https://jwt.io/ site lets you do live verification of JWTs of any kind.
Sure
> Finally, the http://openid.net/developers/libraries/#jwt contains a list of many implementations you could test against.
This is the hardest part as it would require us to understand how other 
libraries work :-), but a good idea indeed

Cheers, Sergey

---

From: Anders Rundgren <[email-masked]>
Date: Thu, 26 May 2016 18:36:27 +0200

> meeting as part of the hackathon?  If so then I can set it up.

Pardon me, I though it was JSON interop. Blush blush...

Anders

---

From: Sergey Beryozkin <[email-masked]>
Date: Thu, 26 May 2016 17:57:26 +0100

Hi Jim, Anders

I was just planning to clarify where my interest was coming from :-),

I'd like to see more JWS/JWE sequences flowing between regular client 
and server applications which are not necessarily OAuth2 applications.

For example, I'd like to see a "Hello World" client written in C# 
posting a JOSE secured "HelloWorld" sequence to a Java server which 
processes it and makes the original "HelloWorld" available to the server.

But I'm sure the situations exist or will exist where OAuth2 clients and 
OIDC servers use/will use different JOSE libraries for 
signing/validating id tokens, etc.

So having some standard interoperability system where some text is 
submitted into a given library, the output is accepted by another 
library, and then somehow it is asserted that the 2nd library did not do 
a false positive validation, and that it correctly reproduced the 
encrypted text, can be useful.

But I guess it can be hard to set up.
If such an interoperability event can be set up then I'll be interested 
in attending, though in a more distant future, I'm not sure when the 
next Hackathon is but looks like it is coming soon :-)

Thanks, Sergey

-- 
Sergey Beryozkin

Talend Community Coders
http://coders.talend.com/

---

From: "Matt Miller (mamille2)" <[email-masked]>
Date: Thu, 26 May 2016 17:27:50 +0000

I was about to suggest this myself.  Feel free to sign me up as co-champion if needed.

--
- m&m

Matt Miller
Cisco Systems, Inc.

> On May 26, 2016, at 10:22, Carsten Bormann <[email-masked]> wrote:
> 
> Jim Schaad wrote:

---

From: Brian Campbell <[email-masked]>
Date: Thu, 26 May 2016 13:47:47 -0600

I'd be interested in bringing my little JOSE/JWT implementation to
something like that, however, I won't arrive in time to do it at IETF 96
unfortunately.

I will second the pointer to https://tools.ietf.org/html/rfc7520 though as
providing a very useful set of test cases.

On Thu, May 26, 2016 at 11:27 AM, Matt Miller (mamille2) <[email-masked]
> wrote: