< draft-jones-json-web-encryption-json-serialization-01.txt		draft-jones-json-web-encryption-json-serialization-02.txt >
	JOSE Working Group M. Jones		JOSE Working Group M. Jones
	Internet-Draft Microsoft		Internet-Draft Microsoft
	Intended status: Standards Track March 12, 2012		Intended status: Standards Track July 6, 2012
	Expires: September 13, 2012		Expires: January 7, 2013
	JSON Web Encryption JSON Serialization (JWE-JS)		JSON Web Encryption JSON Serialization (JWE-JS)
	draft-jones-json-web-encryption-json-serialization-01		draft-jones-json-web-encryption-json-serialization-02
	Abstract		Abstract
	The JSON Web Encryption JSON Serialization (JWE-JS) is a means of		The JSON Web Encryption JSON Serialization (JWE-JS) is a means of
	representing encrypted content using JSON data structures. This		representing encrypted content using JavaScript Object Notation
	specification describes a means of representing secured content as a		(JSON) data structures. This specification describes a means of
	JSON data object (as opposed to the JWE specification, which uses a		representing secured content as a JSON data object (as opposed to the
	compact serialization with a URL-safe representation). It enables		JWE specification, which uses a compact serialization with a URL-safe
	the same content to be encrypted to multiple parties (unlike JWE).		representation). It enables the same content to be encrypted to
	Cryptographic algorithms and identifiers used with this specification		multiple parties (unlike JWE). Cryptographic algorithms and
	are enumerated in the separate JSON Web Algorithms (JWA)		identifiers used with this specification are described in the
	specification. The JSON Serialization for related digital signature		separate JSON Web Algorithms (JWA) specification. The JSON
	and HMAC functionality is described in the separate JSON Web		Serialization for related digital signature and HMAC functionality is
	Signature JSON Serialization (JWS-JS) specification.		described in the separate JSON Web Signature JSON Serialization
			(JWS-JS) specification.
	Requirements Language
	The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
	"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
	document are to be interpreted as described in RFC 2119 [RFC2119].
	Status of this Memo		Status of this Memo
	This Internet-Draft is submitted in full conformance with the		This Internet-Draft is submitted in full conformance with the
	provisions of BCP 78 and BCP 79.		provisions of BCP 78 and BCP 79.
	Internet-Drafts are working documents of the Internet Engineering		Internet-Drafts are working documents of the Internet Engineering
	Task Force (IETF). Note that other groups may also distribute		Task Force (IETF). Note that other groups may also distribute
	working documents as Internet-Drafts. The list of current Internet-		working documents as Internet-Drafts. The list of current Internet-
	Drafts is at http://datatracker.ietf.org/drafts/current/.		Drafts is at http://datatracker.ietf.org/drafts/current/.
	Internet-Drafts are draft documents valid for a maximum of six months		Internet-Drafts are draft documents valid for a maximum of six months
	and may be updated, replaced, or obsoleted by other documents at any		and may be updated, replaced, or obsoleted by other documents at any
	time. It is inappropriate to use Internet-Drafts as reference		time. It is inappropriate to use Internet-Drafts as reference
	material or to cite them other than as "work in progress."		material or to cite them other than as "work in progress."
	This Internet-Draft will expire on September 13, 2012.		This Internet-Draft will expire on January 7, 2013.
	Copyright Notice		Copyright Notice
	Copyright (c) 2012 IETF Trust and the persons identified as the		Copyright (c) 2012 IETF Trust and the persons identified as the
	document authors. All rights reserved.		document authors. All rights reserved.
	This document is subject to BCP 78 and the IETF Trust's Legal		This document is subject to BCP 78 and the IETF Trust's Legal
	Provisions Relating to IETF Documents		Provisions Relating to IETF Documents
	(http://trustee.ietf.org/license-info) in effect on the date of		(http://trustee.ietf.org/license-info) in effect on the date of
	publication of this document. Please review these documents		publication of this document. Please review these documents
	carefully, as they describe your rights and restrictions with respect		carefully, as they describe your rights and restrictions with respect
	to this document. Code Components extracted from this document must		to this document. Code Components extracted from this document must
	include Simplified BSD License text as described in Section 4.e of		include Simplified BSD License text as described in Section 4.e of
	the Trust Legal Provisions and are provided without warranty as		the Trust Legal Provisions and are provided without warranty as
	described in the Simplified BSD License.		described in the Simplified BSD License.
	Table of Contents		Table of Contents
	1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 3		1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 3
			1.1. Notational Conventions . . . . . . . . . . . . . . . . . . 3
	2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . . 3		2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . . 3
	3. JSON Serialization . . . . . . . . . . . . . . . . . . . . . . 3		3. JSON Serialization . . . . . . . . . . . . . . . . . . . . . . 3
	4. Example JWE-JS . . . . . . . . . . . . . . . . . . . . . . . . 4		4. Example JWE-JS . . . . . . . . . . . . . . . . . . . . . . . . 4
	5. IANA Considerations . . . . . . . . . . . . . . . . . . . . . . 5		5. IANA Considerations . . . . . . . . . . . . . . . . . . . . . . 5
	6. Security Considerations . . . . . . . . . . . . . . . . . . . . 5		6. Security Considerations . . . . . . . . . . . . . . . . . . . . 6
	7. Open Issues and Things To Be Done (TBD) . . . . . . . . . . . . 6		7. Open Issues . . . . . . . . . . . . . . . . . . . . . . . . . . 6
	8. References . . . . . . . . . . . . . . . . . . . . . . . . . . 6		8. References . . . . . . . . . . . . . . . . . . . . . . . . . . 6
	8.1. Normative References . . . . . . . . . . . . . . . . . . . 6		8.1. Normative References . . . . . . . . . . . . . . . . . . . 6
	8.2. Informative References . . . . . . . . . . . . . . . . . . 6		8.2. Informative References . . . . . . . . . . . . . . . . . . 6
	Appendix A. Acknowledgements . . . . . . . . . . . . . . . . . . . 6		Appendix A. Acknowledgements . . . . . . . . . . . . . . . . . . . 7
	Appendix B. Document History . . . . . . . . . . . . . . . . . . . 7		Appendix B. Document History . . . . . . . . . . . . . . . . . . . 7
	Author's Address . . . . . . . . . . . . . . . . . . . . . . . . . 7		Author's Address . . . . . . . . . . . . . . . . . . . . . . . . . 7
	1. Introduction		1. Introduction
	The JSON Web Encryption JSON Serialization (JWE-JS) is a format for		The JSON Web Encryption JSON Serialization (JWE-JS) is a format for
	representing encrypted content as a JSON RFC 4627 [RFC4627] object.		representing encrypted content as a JavaScript Object Notation (JSON)
	It enables the same content to be encrypted to multiple parties		[RFC4627] object. It enables the same content to be encrypted to
	(unlike JWE [JWE].) The encryption mechanisms are independent of the		multiple parties (unlike JWE [JWE].) The encryption mechanisms are
	type of content being encrypted. Cryptographic algorithms and		independent of the type of content being encrypted. Cryptographic
	identifiers used with this specification are enumerated in the		algorithms and identifiers used with this specification are described
	separate JSON Web Algorithms (JWA) [JWA] specification. The JSON		in the separate JSON Web Algorithms (JWA) [JWA] specification. The
	Serialization for related digital signature and HMAC functionality is		JSON Serialization for related digital signature and HMAC
	described in the separate JSON Web Signature JSON Serialization		functionality is described in the separate JSON Web Signature JSON
	(JWS-JS) [JWS-JS] specification.		Serialization (JWS-JS) [JWS-JS] specification.
			1.1. Notational Conventions
			The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
			"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
			document are to be interpreted as described in Key words for use in
			RFCs to Indicate Requirement Levels [RFC2119].
	2. Terminology		2. Terminology
	This specification uses the same terminology as the JSON Web		This specification uses the same terminology as the JSON Web
	Encryption (JWE) [JWE] specification.		Encryption (JWE) [JWE] specification.
	3. JSON Serialization		3. JSON Serialization
	The JSON Serialization represents encrypted content as a JSON object		The JSON Serialization represents encrypted content as a JSON object
	with members for each of four constituent parts: a "headers" member		with members for each of four constituent parts: a "headers" member
	skipping to change at page 4, line 46 ¶		skipping to change at page 5, line 6 ¶
	parameter value in the JWE Header for each recipient MUST be the		parameter value in the JWE Header for each recipient MUST be the
	same, as MUST be the "iv" (initialization vector) value (when		same, as MUST be the "iv" (initialization vector) value (when
	required for the algorithm).		required for the algorithm).
	4. Example JWE-JS		4. Example JWE-JS
	This section contains an example using the JWE JSON Serialization.		This section contains an example using the JWE JSON Serialization.
	This example demonstrates the capability for encrypting the same		This example demonstrates the capability for encrypting the same
	plaintext to multiple recipients.		plaintext to multiple recipients.
	Two recipients are present in this example: the first using the RSA-		Two recipients are present in this example: the first using the
	PKCS1_1.5 algorithm to produce the JWE Encrypted Key and the second		RSAES-PKCS1-V1_5 algorithm to encrypt the Content Master Key (CMK)
	using the ECDH-ES algorithm to produce the JWE Encrypted Key. The		and the second using the AES Key Wrap algorithm to encrypt the CMK.
	Plaintext is encrypted using the AES-256-CBC algorithm to produce the		The Plaintext is encrypted using the AES CBC algorithm to produce the
	JWE Ciphertext. The two Decoded JWE Header Segments used are:		JWE Ciphertext. The two Decoded JWE Header Segments used are:
	{"alg":"RSA1_5",		{"alg":"RSA1_5",
	"enc":"A256CBC",		"x5t":"7noOPq-hJ1_hCnvWh6IeYI2w9Q0",
	"int":"HS256",		"enc":"A128CBC",
	"iv":"Mz-mW_4JHfg",		"iv":"__79_Pv6-fj39vX08_Lx8A",
	"x5t":"7noOPq-hJ1_hCnvWh6IeYI2w9Q0"}		"int":"HS256"}
	and:		and:
	{"alg":"ECDH-ES",		{"alg":"A128KW",
	"enc":"A256CBC",		"enc":"A128CBC",
	"epk":{		"iv":"__79_Pv6-fj39vX08_Lx8A",
	"alg":"EC",		"int":"HS256"}
	"crv":"P-256",
	"x":"235RT7iKTI3KWvS4_mIwUhX6OC_X2I-bsOpS5w7MGA4",
	"y":"ZSv0dtvXs4o2XsIVhFzgiMTSg9uSsytaOvC-XRtfoIM"},
	"jku":"https://example.com/public_key.jwk"}
	The complete JSON Web Encryption JSON Serialization (JWE-JS) for		The complete JSON Web Encryption JSON Serialization (JWE-JS) for
	these values is as follows (with line breaks for display purposes		these values is as follows (with line breaks for display purposes
	only):		only):
	{"headers":[		{"headers":[
	"eyJhbGciOiJSU0ExXzUiLA0KICJlbmMiOiJBMjU2Q0JDIiwNCiAiaW50IjoiS		"eyJhbGciOiJSU0ExXzUiLA0KICJlbmMiOiJBMjU2Q0JDIiwNCiAiaW50IjoiS
	FMyNTYiLA0KICJpdiI6Ik16LW1XXzRKSGZnIiwNCiAieDV0IjoiN25vT1BxLWhKM		FMyNTYiLA0KICJpdiI6Ik16LW1XXzRKSGZnIiwNCiAieDV0IjoiN25vT1BxLWhKM
	V9oQ252V2g2SWVZSTJ3OVEwIn0",		V9oQ252V2g2SWVZSTJ3OVEwIn0",
	"eyJhbGciOiJFQ0RILUVTIiwNCiAiZW5jIjoiQTI1NkNCQyIsDQogImVwayI6e		"eyJhbGciOiJFQ0RILUVTIiwNCiAiZW5jIjoiQTI1NkNCQyIsDQogImVwayI6e
	w0KICAiYWxnIjoiRUMiLA0KICAiY3J2IjoiUC0yNTYiLA0KICAieCI6IjIzNVJUN		w0KICAiYWxnIjoiRUMiLA0KICAiY3J2IjoiUC0yNTYiLA0KICAieCI6IjIzNVJUN
	skipping to change at page 6, line 6 ¶		skipping to change at page 6, line 10 ¶
	5. IANA Considerations		5. IANA Considerations
	This specification makes no requests of IANA.		This specification makes no requests of IANA.
	6. Security Considerations		6. Security Considerations
	The security considerations for this specification are the same as		The security considerations for this specification are the same as
	those for the JSON Web Encryption (JWE) [JWE] specification.		those for the JSON Web Encryption (JWE) [JWE] specification.
	7. Open Issues and Things To Be Done (TBD)		7. Open Issues
	The following items remain to be done in this draft:		[[ to be removed by the RFC editor before publication as an RFC ]]
			The following items remain to be considered or done in this draft:
	o Complete the example.		o Complete the example.
	o Track changes that occur in the JWE spec.		o Track changes that occur in the JWE spec.
	8. References		8. References
	8.1. Normative References		8.1. Normative References
	[JWA] Jones, M., "JSON Web Algorithms (JWA)", March 2012.		[JWA] Jones, M., "JSON Web Algorithms (JWA)", July 2012.
	[JWE] Jones, M., Rescorla, E., and J. Hildebrand, "JSON Web		[JWE] Jones, M., Rescorla, E., and J. Hildebrand, "JSON Web
	Encryption (JWE)", March 2012.		Encryption (JWE)", July 2012.
	[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate		[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
	Requirement Levels", BCP 14, RFC 2119, March 1997.		Requirement Levels", BCP 14, RFC 2119, March 1997.
	[RFC4627] Crockford, D., "The application/json Media Type for		[RFC4627] Crockford, D., "The application/json Media Type for
	JavaScript Object Notation (JSON)", RFC 4627, July 2006.		JavaScript Object Notation (JSON)", RFC 4627, July 2006.
	8.2. Informative References		8.2. Informative References
	[I-D.rescorla-jsms]		[I-D.rescorla-jsms]
	Rescorla, E. and J. Hildebrand, "JavaScript Message		Rescorla, E. and J. Hildebrand, "JavaScript Message
	Security Format", draft-rescorla-jsms-00 (work in		Security Format", draft-rescorla-jsms-00 (work in
	progress), March 2011.		progress), March 2011.
	[JSE] Bradley, J. and N. Sakimura (editor), "JSON Simple		[JSE] Bradley, J. and N. Sakimura (editor), "JSON Simple
	Encryption", September 2010.		Encryption", September 2010.
	[JWS-JS] Jones, M., Bradley, J., and N. Sakimura, "JSON Web		[JWS-JS] Jones, M., Bradley, J., and N. Sakimura, "JSON Web
	Signature JSON Serialization (JWS-JS)", March 2012.		Signature JSON Serialization (JWS-JS)", July 2012.
	Appendix A. Acknowledgements		Appendix A. Acknowledgements
	JSON serializations for encrypted content were previously explored by		JSON serializations for encrypted content were previously explored by
	JSON Simple Encryption [JSE] and JavaScript Message Security Format		JSON Simple Encryption [JSE] and JavaScript Message Security Format
	[I-D.rescorla-jsms].		[I-D.rescorla-jsms].
	Appendix B. Document History		Appendix B. Document History
			[[ to be removed by the RFC editor before publication as an RFC ]]
			-02
			o Updated examples to track updated algorithm properties in the JWA
			spec.
			o Tracked editorial changes made to the JWE spec.
	-01		-01
	o Tracked changes between JOSE JWE draft -00 and -01, which added an		o Tracked changes between JOSE JWE draft -00 and -01, which added an
	integrity check for non-AEAD algorithms.		integrity check for non-AEAD algorithms.
	-00		-00
	o Created the initial version incorporating JOSE working group input		o Created the initial version incorporating JOSE working group input
	and drawing from the JSON Serialization previously proposed in		and drawing from the JSON Serialization previously proposed in
	draft-jones-json-web-token-01.		draft-jones-json-web-token-01.
End of changes. 19 change blocks.
	54 lines changed or deleted		64 lines changed or added
This html diff was produced by rfcdiff 1.48. The latest version is available from http://tools.ietf.org/tools/rfcdiff/