Subject: [Cose] Issue: Identification of the top level objects

From: "Jim Schaad" <[email-masked]>
Date: Thu, 30 Apr 2015 15:58:19 -0700

Question:  Identification of objects:
a)  CBOR Tag - either general or specific to each type
b)  Required Identifier
c)  Use the same techniques as JOSE

Discussion:

One of the things that I have never liked with the JOSE document is the
method that is used to determine the type of object that one is dealing
with.   I would lie to get this corrected so that it is simple to make this
determination.  

The method used by JOSE can be found in Section 9 of the encryption draft
(http://tools.ietf.org/html/draft-ietf-jose-json-web-encryption-40#section-9
).  It consists of looking at the keys in the top level map or by looking at
the value of the 'alg' header property in the message.  Based on this one
determines what the message type is.  Although not documented in this
section, there is also a header parameter 'typ' that, in theory, is used to
identify different types of a JOSE object.  This is based on the idea that a
"timestamp signature" should be marked as being different than a "normal
signature".  The 'typ' header parameter uses a Mime Media type as its value.

The current document uses an enumeration to make the determination what the
type of object is.  This allows for an open ended set of values where the
value can be changed if/when a new version of one of the structures is
created.  The enumeration could also be used to replace the 'typ' element by
assigning new values to it based on the special needs of a security
operation.  The use of an enumeration makes more sense for arrays than for
maps.  However, this could be translated by defining a new field to contain
the enumeration.

It has been suggested that CBOR Tags could be assigned to designate the
different security messages as well.  If this approach is done, I would
expect that new  versions would need to be identified by either a new field,
or by re-naming the map keys when items are changed.  It would not make
sense to keep adding new CBOR tags as the versions change unless it was a
complete re-design.

It would be possible to assign just a single CBOR Tag for identification of
COSE security objects in a message and then use one of the first two
techniques to determine which of the security objects is being used.

Jim