Subject: [jose] JWS-JS on disk

From: Daniel Holth <[email-masked]>
Date: Thu, 23 Aug 2012 16:58:08 -0400

I'm attempting to design a JWS-JS-inspired format into a code signing
mechanism for Python wheel files. It works. The payload just includes
a hash of a manifest that in turn includes the hash of all the other
files in the archive, and the signatures always include the full
verifying key for the Ed25519 system in the header, like so. I like
it, but want a place to include information about the signature itself
(when was this signature added?) apart from the single payload. I see
there is some discussion of split headers that may provide it.

That's all. I really like the spec so far.

Daniel Holth

{'alg': 'Ed25519',
   'key': {'alg': 'Ed25519',
            'vk': u'dSUK9K1lSClpgCrtjTpywL3o-TfyCHQsD4xC6ey1GH4'},
   'typ': 'JWT'}

 {'hash': 'sha256=N7if_qZx7EVe4hN72ajBrWZ5Gwqs74nkK1vWLGTQTFY'}

{"headers": ["eyJhbGciOiAiRWQyNTUxOSIsICJrZXkiOiB7ImFsZyI6ICJFZDI1NTE5IiwgInZrIjogImRTVUs5SzFsU0NscGdDcnRqVHB5d0wzby1UZnlDSFFzRDR4QzZleTFHSDQifSwgInR5cCI6ICJKV1QifQ"],
"payload": "eyJoYXNoIjogInNoYTI1Nj1ON2lmX3FaeDdFVmU0aE43MmFqQnJXWjVHd3FzNzRua0sxdldMR1RRVEZZIn0",
"signatures": ["KFt27VW2tM5Q637Mu4kyfqBRrxzJ9MRZ6O7ax8lSnKuVLMGG6bcNKkLqombv12bUV-8I-n-SlQfaGlSqnn_xAw"]}

---

From: Nat Sakimura <[email-masked]>
Date: Fri, 24 Aug 2012 11:09:30 +0900

There is "iat" (issued at) claim in JWT
http://tools.ietf.org/html/draft-ietf-oauth-json-web-token-01
I would use it to show when it was signed.

Nat

On Fri, Aug 24, 2012 at 5:58 AM, Daniel Holth <[email-masked]> wrote:

> {"headers":
> ["eyJhbGciOiAiRWQyNTUxOSIsICJrZXkiOiB7ImFsZyI6ICJFZDI1NTE5IiwgInZrIjogImRTVUs5SzFsU0NscGdDcnRqVHB5d0wzby1UZnlDSFFzRDR4QzZleTFHSDQifSwgInR5cCI6ICJKV1QifQ"],
> "payload":
> "eyJoYXNoIjogInNoYTI1Nj1ON2lmX3FaeDdFVmU0aE43MmFqQnJXWjVHd3FzNzRua0sxdldMR1RRVEZZIn0",
> "signatures":
> ["KFt27VW2tM5Q637Mu4kyfqBRrxzJ9MRZ6O7ax8lSnKuVLMGG6bcNKkLqombv12bUV-8I-n-SlQfaGlSqnn_xAw"]}
> _______________________________________________
> jose mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/jose
>

-- 
Nat Sakimura (=nat)
Chairman, OpenID Foundation
http://nat.sakimura.org/
@_nat_en

---

From: Daniel Holth <[email-masked]>
Date: Fri, 24 Aug 2012 01:57:42 -0400

Yes, but IIUC iat goes in the payload only according to the spec, so
the first signer can put it in, but if the second signature comes
along the next day there is no place for iat to go, because the second
signer only adds a new header. An obvious solution might be to just
put another iat in the second header.

---

From: Daniel Holth <[email-masked]>
Date: Fri, 24 Aug 2012 09:15:54 -0400

Since my payload is so boring, I may just go with a list of complete
JWT's or a file with one-per-line / whitespace separated as a
multi-signature format.