Subject: [Json] Another take on "Signed JSON"

From: Anders Rundgren <[email-masked]>
Date: Wed, 30 May 2018 10:12:15 +0200

Since JWS [RFC7515] in standard mode transforms JSON Objects into something entirely different as well as encoding data in Base64Url, various approaches have been suggested to create a more "JSON-friendly" signature solution.

Using JWS in detached mode (https://tools.ietf.org/html/rfc7515#appendix-F) is an established way of achieving this objective, usually with an HTTP header holding the actual JWS object.

However, it turns out that by applying a not particularly complex canonicalization scheme (https://tools.ietf.org/html/draft-rundgren-json-canonicalization-scheme-00#section-3.2), you can create a transport-independent, in-object (enveloped) JSON signature solution, without touching the JWS standard or associated libraries.

Documentation: https://github.com/cyberphone/jws-jcs#combining-detached-jws-with-jcs-json-canonicalization-scheme
On-line demo: https://mobilepki.org/jws-jcs/home

// Anders