Subject: [jose] Question regarding RFC 7515

From: George Aristy <[email-masked]>
Date: Fri, 11 Oct 2019 17:41:57 +0000

Hi

Are there any plans to support signature chains?

--
George Aristy | Software Engineer, Exchange Team | SecureKey Technologies
4101 Yonge Street, Suite 501 | Toronto, ON M2P 1N6 | Phone: +1.905.251.6502
[https://verified.me/wp-content/uploads/email_signatures/verifiedmelogo.png]<https://verified.me/>

[https://verified.me/wp-content/uploads/email_signatures/appstore.png]<https://itunes.apple.com/ca/app/verified-me/id1090441769?ls=1&mt=8> [https://verified.me/wp-content/uploads/email_signatures/googleplay.png] <https://play.google.com/store/apps/details?id=com.securekey.verifiedme>

This email and any attachments are for the sole use of the intended recipients and may be privileged, confidential or otherwise exempt from disclosure under law. Any distribution, printing or other use by anyone other than the intended recipient is prohibited. If you are not an intended recipient, please contact the sender immediately, and permanently delete this email and its attachments.

---

From: Anders Rundgren <[email-masked]>
Date: Sat, 12 Oct 2019 05:34:42 +0200

> Are there any plans to support signature chains?

Hi George,

The JOSE WG is concluded and no successor has to my knowledge been proposed.
JSF (JSON Signature Format) is a live specification (https://cyberphone.github.io/doc/security/jsf.html) which currently only supports multiple signatures like below.  It would though be a small thing adding "chained" to the spec where it would syntactically be at the same place as "signers".

{
   "now": "2019-02-10T11:23:06Z",
   "name": "Joe",
   "id": 2200063,
   "signature": {
     "signers": [{
       "algorithm": "ES256",
       "publicKey": {
         "kty": "EC",
         "crv": "P-256",
         "x": "censDzcMEkgiePz6DXB7cDuwFemshAFR90UNVQFCg8Q",
         "y": "xq8rze6ewG0-eVcSF72J77gKiD0IHnzpwHaU7t6nVeY"
       },
       "value": "yI_ucBjb2uOGK07B5y5swXmTRO8jqrCAktE4mQlxLhc05hAksE-MuSEgnO14InByLcxWwe2xp6qXDQZlOHjFAg"
     },{
       "algorithm": "RS256",
       "publicKey": {
         "kty": "RSA",
         "n": "hFWEXArvaZEpSP5qNX7x4C4Hl28GJQTNvnDwkfqiWs63kXbdyPeS06bz6GnY3tfQ_093nGauWsimqKBmGAGMPtsV83Qxw1OIeO4ujbIIb9pema0qtVqs0MWlHxklZGFkYfAmbuEUFxYDeLDHe0bkkXbSlB7_t8pCSvc8HLgHjEQjYOlFRwjR0D-uLo-xgsCbpmCtYkB5lcT_zFgpRgY4zJNLSv7GZiz2S4Fc5ArGjd34lL47-L8bozuYjqNOv9sqX0Zgll5XaJ1ndvr7UqZu1xQFgm38reoM3IarBP_SkEFbt_v9iak602VO3k28fQhMaocP7JWR2YLT3kZM0-WTFw",
         "e": "AQAB"
       },
       "value": "aF3qTpIFGcJxB5En-JFQZWGqX-vOoGrs27SKBz_mNjmJRDdAeE-0NnmF16elUh2YmFWFfZd_SLnbrlkKE2adlOqxqWiQYcB1smKSOQ3dTwAYLcD4ebuBgDBKRs9ZO_GPBeSpwH5FGpUQbSPGh7BWD69OPF6Ik5vHPikfls-fr1qgrxpYARY1vUhXvl-QFtBvnd3Xn_n63kFQl4GZDeP6TZyuoaulTKsFBvhHu0OfqknoOzEUYJYMhS9r5rDz_AVbnx_F1Key-gQnm6UmuVothu_ApYy_NW4HEVKZfxhU_nYzuGYQD9VUI9WYmstBcLyS3uNPHDECoEy0hQ4UpZPMBg"
     }]
   }
}

JSF is not on "standards track" but may emerge as an independent RFC.  In case you are programming in Java, code is readily available.

Regards,
Anders

> 
> -- 
> *George Aristy* | Software Engineer, Exchange Team | *SecureKey Technologies*
> <https://verified.me/>
> <https://itunes.apple.com/ca/app/verified-me/id1090441769?ls=1&mt=8> <https://play.google.com/store/apps/details?id=com.securekey.verifiedme>
> 
> _______________________________________________
> jose mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/jose
>

---

From: Anders Rundgren <[email-masked]>
Date: Sat, 12 Oct 2019 17:21:03 +0200

Done :)

You may verify the following sample using an on-line "lab": https://mobilepki.org/jsf/home

{
   "now": "2019-02-10T11:23:06Z",
   "name": "Joe",
   "id": 2200063,
   "signature": {
     "chain": [{
       "algorithm": "ES256",
       "publicKey": {
         "kty": "EC",
         "crv": "P-256",
         "x": "censDzcMEkgiePz6DXB7cDuwFemshAFR90UNVQFCg8Q",
         "y": "xq8rze6ewG0-eVcSF72J77gKiD0IHnzpwHaU7t6nVeY"
       },
       "value": "z3YILoyx1GURBuQaF6Oo9XBIOEXfzeulkq_8kDyXGo3raAmGMLiRTsyqwgLFHNMuih41GIdmYfJ4zs7pvtF6uA"
     },{
       "algorithm": "RS256",
       "publicKey": {
         "kty": "RSA",
         "n": "hFWEXArvaZEpSP5qNX7x4C4Hl28GJQTNvnDwkfqiWs63kXbdyPeS06bz6GnY3tfQ_093nGauWsimqKBmGAGMPtsV83Qxw1OIeO4ujbIIb9pema0qtVqs0MWlHxklZGFkYfAmbuEUFxYDeLDHe0bkkXbSlB7_t8pCSvc8HLgHjEQjYOlFRwjR0D-uLo-xgsCbpmCtYkB5lcT_zFgpRgY4zJNLSv7GZiz2S4Fc5ArGjd34lL47-L8bozuYjqNOv9sqX0Zgll5XaJ1ndvr7UqZu1xQFgm38reoM3IarBP_SkEFbt_v9iak602VO3k28fQhMaocP7JWR2YLT3kZM0-WTFw",
         "e": "AQAB"
       },
       "value": "G0ZEFIhcsVPG5r7-XMNjruXXvN7V63H9dnAVzcrsbwWk9Z8x9fIjT0UEazsWzpMvgKRsDayuMk6WIl7nOYiDrTOM6C_BI0U7jDxrK7dunIGQ-z5RN6pvF4Q27mOHx7yjVVsPBN5VTl4JVT6HQnfpzPe1uZiFRG2hw5BYZa-vvkBcZb6bWOClTsn2i7zLQbVA-5vTGa7zJtOmuLwBEf_GFf_o3pN0Bjx94S87KwoaWfLAaBPMgFZIDoNGgW5hmBJj1-YKp4l9WgsX2I7M8rvg5ptEupV9HDRiH3kivybUHDibOoun1-D1bkKRgA447ug1gxrvpI3dSLKb-QQd4j7b7A"
     }]
   }
}