2

I want to send a java object to a server and send its signature through another way to the server. for this, I need to convert it to JSON and then create a signature form JSON. I know that I can create a signed token with JOSE but it will also attach object data to the token, and it makes token too long. Also, It is required to sign one object multiple time by different signers.

Is there any standard or tool (at least for java/javascript) to guaranty that conversation of JSON to string always represent in unique format?

Is it possible to omit the second part of JWT which contains JSON data and create in using an arbitrary JSON creator?

If non of the answers are yes, what should I do?

Hossein Nasr
  • 1,436
  • 2
  • 20
  • 40

1 Answers1

2

JOSE is a framework, not a standard. JSON Web Signature (JWS) is a standard defined in RFC 7515, and JSON Web Token (JWT) is a compact token format using JWS signature defined in RFC 7519

Is there any standard or tool (at least for java/javascript) to guaranty that conversation of JSON to string always represent in unique format?

Yes, JWS defines that JWS Payload is encoded as BASE64URL(UTF8(JWS Payload))

Is it possible to omit the second part of JWT which contains JSON data and create in using an arbitrary JSON creator?

You can omit the second part of JWT (the payload), but then it won't be a JWT. I think you do not need JWT (the purpose of JWT is exchange authentication tokens) but apply a digital signature to your document. And JWS is suitable for this

But, with several signers you will need an additional layer of digital signature capabilities. For example to include the signer's identity, relate the content signed with the signer or set the order of signatures.

Unfortunately there is no a standard to do this, like XAdES, PAdES or CAdES for XML, PDF and binary documents

Community
  • 1
  • 1
pedrofb
  • 37,271
  • 5
  • 94
  • 142
  • I believe that `BASE64URL(UTF8(JWS Payload))` will not guaranty uniqueness of same objects. According to [this post](http://stackoverflow.com/a/4670638/1385652) there are multiple ways to display a JSON object in string and `BASE64URL(UTF8(JWS Payload))` simply does not consider them and removing payload part makes us unable to verify the signature of the payload. – Hossein Nasr Oct 31 '16 at 07:40
  • 1
    Be aware that the post is talking about signing a json object, and the need of canonicalize the content before signing. JWS performs the canonicalization serializing the JSON object as base64url. Two different values can not generate the same base64 value (see http://stackoverflow.com/questions/30429168/is-a-base64-encoded-string-unique), but the base64 serialization always produce the same result – pedrofb Oct 31 '16 at 08:20