Subject: [jose] JWK counterpart to ds:CryptoBinary?

From: Anders Rundgren <[email-masked]>
Date: Sun, 01 Dec 2013 18:00:35 +0100

Hi List

Pardon a non-cryptographer, but does JWK have a counterpart to
   http://www.w3.org/TR/xmldsig-core/#sec-CryptoBinary
?

If not, why?

>From what I can deduct the following implementation use CryptoBinary for both EC and RSA public keys:

https://bitbucket.org/nimbusds/nimbus-jose-jwt/src/6d6938b94f7a6051636bf654864a78b708fa392f/src/main/java/com/nimbusds/jose/util/BigIntegerUtils.java?at=master

thanx,
Anders

---

From: Anders Rundgren <[email-masked]>
Date: Sat, 07 Dec 2013 06:05:59 +0100

Well, a peek in another JOSE implementation seems to verify that this is an _implicit_ (understood) part of the specification:

https://bitbucket.org/b_c/jose4j/src/b782e9638a84431a58234b7258c2186da4e8189f/src/main/java/org/jose4j/keys/BigEndianBigInteger.java

As a non-cryptographer I interpret this as: X and Y for EC public keys must always be positive and this is also the case for RSA public exponent and modulus.

In an early version of an XML DSig implementation of mine I occasionally got run-time errors which was how I found out about ds:CryptoBinary...

Anders

---

From: Brian Campbell <[email-masked]>
Date: Tue, 10 Dec 2013 13:41:06 -0700

I am likewise a non-cryptographer but that's my code so I guess I should
comment :)

The understanding of that part of the specs comes from the text, "...
represented as the base64url encoding of the value's unsigned big endian
representation as an octet sequence."  The spec drafts have been updated
over time and the appearances of that text have moved around since I wrote
that code but I think the intent hasn't changed  The text is currently used
in each of the parameters for RSA keys
http://tools.ietf.org/html/draft-ietf-jose-json-web-algorithms-18#section-6.3.
The same text was there for EC keys as well but recently was change to
reference SEC1 (which I'm told is basically the same for for prime curves).

On Fri, Dec 6, 2013 at 10:05 PM, Anders Rundgren <
[email-masked]> wrote:

> Well, a peek in another JOSE implementation seems to verify that this is
> an _implicit_ (understood) part of the specification:
>
>
> As a non-cryptographer I interpret this as: X and Y for EC public keys
> must always be positive and this is also the case for RSA public exponent
> and modulus.
>
> In an early version of an XML DSig implementation of mine I occasionally
> got run-time errors which was how I found out about ds:CryptoBinary...
>
> Anders
>
>
> _______________________________________________
> jose mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/jose
>

---

From: Anders Rundgren <[email-masked]>
Date: Tue, 10 Dec 2013 22:17:12 +0100

On 2013-12-10 21:41, Brian Campbell wrote:
> I am likewise a non-cryptographer but that's my code so I guess I should comment :)
>
> The understanding of that part of the specs comes from the text, "... represented as the base64url encoding of the value's unsigned big endian representation as an octet sequence."  The spec drafts have been updated over time and the appearances of that text have moved around since I wrote that code but I think the intent hasn't changed  The text is currently used in each of the parameters for RSA keys http://tools.ietf.org/html/draft-ietf-jose-json-web-algorithms-18#section-6.3. The same text was there for EC keys as well but recently was change to reference SEC1 (which I'm told is basically the same for for prime curves).

Brian, thank very much for pointing me to the right places!
I'm happy to see that I'm still on the right track :-)

Cheers
Anders

>
>
>
>
> On Fri, Dec 6, 2013 at 10:05 PM, Anders Rundgren <[email-masked] <mailto:[email-masked]>> wrote:
>
>     [email-masked] <mailto:[email-masked]>