Subject: Re: [jose] On-line signature demo app using WebCrypto & JOSE/JWS

From: Sergey Beryozkin <[email-masked]>
Date: Mon, 01 Dec 2014 12:07:15 +0000

Hi Anders

Thanks for sharing a link to this demo.

I'm just thinking, this browser client can become a very useful testing 
mechanism for servers directly supporting JWS/JWE, etc.

Would you be open to getting the demo enhanced to support submitting the 
signed documents to a custom endpoint URI acting as a trusted 
intermediary ?

Something along these lines: the signed document is optionally posted to 
a custom endpoint (JWS only, and if a user provides a custom URI). The 
custom endpoint would decode, add a custom JWS header, re-sign and 
forward to the original demo endpoint. Or something simpler, but such 
that a custom JWS implementation is asked to do both sign and verify 
actions.

I'm sorry if it is off-topic for the list, I'll be happy to join a more 
dedicated list to continue or do a private discussion if it can be of 
interest.

Cheers, Sergey

On 25/11/14 07:07, Anders Rundgren wrote:
> Using Chrome or Firefox/beta you may try:
>
> https://mobilepki.org/WCPPSignatureDemo
>
> Anders
>
> _______________________________________________
> jose mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/jose

---

From: Anders Rundgren <[email-masked]>
Date: Tue, 02 Dec 2014 09:59:41 +0100

> Hi Anders

Hi Sergey
> signed documents to a custom endpoint URI acting as a trusted

I could imagine doing so but I feel that it would be a rather big undertaking
since people would probably want to upload their own keys, specify headers etc.
which would make the GUI part pretty elaborate.  I guess that creating erroneous
data, signatures and headers would also be interesting to see that that the other
end reacts in the expected fashion?

Anyway, the code is published and under a Mozilla license so it is possible
to start with this.  The crypto turned out to be the easy part :-)
The XML DSig enveloped signature using pure JS+WebCrypto only took
a day or so to get right.  JWS Compact is about 10 lines of JS excluding
the Base64/UTF8 support which still seems to be missing in browsers.

For testing I would consider a command-line utility using your excellent
Nimbus tool-box.

Cheers,
Anders

---

From: Sergey Beryozkin <[email-masked]>
Date: Tue, 02 Dec 2014 09:58:25 +0000

Hi Anders
> end reacts in the expected fashion?
I was thinking of getting the optional routing added via a custom 
endpoint only - the keys, the documents, all the materials are not changed
> the Base64/UTF8 support which still seems to be missing in browsers.
Sure. I guess you are right - can be easy enough to do most of it, I 
thought may be it would be some kind of the interoperability testing 
tool...but I agree otherwise

> For testing I would consider a command-line utility using your excellent
I'm not involved in the project, sorry :-)

Cheers, Sergey