> -----Original Message----- > From: Mike Jones [mailto:[email protected]] > Sent: Tuesday, October 14, 2014 5:46 AM > To: Pete Resnick; The IESG > Cc: [email protected]; [email protected]; draft-ietf-jose-json-web- > [email protected] > Subject: RE: Pete Resnick's Discuss on draft-ietf-jose-json-web-signature-33: > (with DISCUSS and COMMENT) > > > -----Original Message----- > > From: jose [mailto:[email protected]] On Behalf Of Mike Jones > > Sent: Saturday, October 04, 2014 6:58 PM > > To: Pete Resnick; The IESG > > Cc: [email protected]; [email protected]; > > draft-ietf-jose-json-web- [email protected] > > Subject: Re: [jose] Pete Resnick's Discuss on > > draft-ietf-jose-json-web-signature- > > 33: (with DISCUSS and COMMENT) > > > > Thanks for your review, Pete. I've added the working group to the thread. > > Replies are inline below... > > > > > -----Original Message----- > > > From: Pete Resnick [mailto:[email protected]] > > > Sent: Wednesday, October 01, 2014 9:14 PM > > > To: The IESG > > > Cc: [email protected]; draft-ietf-jose-json-web- > > > [email protected] > > > Subject: Pete Resnick's Discuss on > > > draft-ietf-jose-json-web-signature-33: (with DISCUSS and COMMENT) > > > > > > -------------------------------------------------------------------- > > > -- > > > COMMENT: > > > -------------------------------------------------------------------- > > > -- > > > > > > 3.2: > > > > > > In the JWS JSON Serialization, a JWS object is represented as the > > > combination of these four values, > > > BASE64URL(UTF8(JWS Protected Header)), > > > JWS Unprotected Header, > > > BASE64URL(JWS Payload), and > > > BASE64URL(JWS Signature) > > > > > > Why is the Payload (a) part of the serialization and (b) base64ed? > > > Are you saying that the only way I can use JWS is to include the > > > payload as part of the JOSE object? Why can't it be a separate > > > thing? Also, why does it > > have to be base64ed? > > > It could be a UTF-8 string, or it could be a large binary object > > > that I'm using in a non-JSON context, neither of which I want to > > > bloat by base64ing it. This seems bogus. > > > > It is base64url encoded because JSON has no way of representing > > arbitrary octet sequences. This enables the "binary object" case that > you're describing to work. > > Also note that this was extensively discussed by the working group in > > the context of issue #26 http://trac.tools.ietf.org/wg/jose/trac/ticket/26.
Pete, would a pointer to Appendix F at some point be useful? This describes how to do detached content. _______________________________________________ jose mailing list [email protected] https://www.ietf.org/mailman/listinfo/jose
