cyberphone / jws-ct Goto Github PK

Qn. Since a key objective is to maintain human readability and general JSON-ness, why not leverage the JWS JSON serialized structures for the meta-info?

   …the syntax of a JWS using the flattened JWS JSON
   Serialization is as follows:
     {
      "payload":"<payload contents>",
      "protected":"<integrity-protected header contents>",
      "header":<non-integrity-protected header contents>,
      "signature":"<signature contents>"
     }

(or it's less-flat alternative for multi-sig) https://tools.ietf.org/html/rfc7515#section-7.2

I'm coming at this from wanting to avoid the complexity overhead of JSON-LD Signatures for (as you suggest) persistent signed JSON documents; finding https://tools.ietf.org/html/rfc7797; thinking all that was missing was some canonicalization; digging into JCS and https://gibson042.github.io/canonicaljson-spec/; discovering that all the 7797 implementations are focussed on detached serializations; and that all the payload examples seem to be of simple strings rather than anything with structure ☹️

And now stumbling across your jws-jcs which also uses the Base64 encoded detached (then re-attached) header and signature, I'm left thinking I must be missing something!??

(although, tbh, I'm not much of a fan of 'payload' as a property name, 'contents' or 'document' or 'body' would be more natural perhaps)

—edit—

So, when I wrote the above, I hadn't realized that this repo belonged to the JCS author/proposer, rather than just some random person's experiment! Thanks for JCS - I really don't understand how there isn't yet a standard for signed JSON documents that are, umm, JSON documents!