Javascript Object Signing and Encryption
charter-ietf-jose-01-02

JavaScript Object Notation (JSON) is a text format for the serialization
of structured data described in RFC 4627. The JSON format is often used
for serializing and transmitting structured data over a network
connection. With the increased usage of JSON in protocols in the IETF
and elsewhere, there is now a desire to offer security services for JSON
with encryption, digital signatures, and message authentication codes
(MACs).

Different proposals for providing such security services have already
been defined and implemented. This Working Group will standardize the
mechanism for integrity protection (signature and MAC) and encryption as
well as the format for keys and algorithm identifiers to support
interoperability of security services for protocols that use JSON. The
Working Group will base its work on well-known message security
primitives (e.g., CMS), and will solicit input from the rest of the IETF
Security Area to be sure that the security functionality in the JSON
format is sound. The WG will strive to gather use cases to ensure the
broadest possible applicability of the mechanism.

As JSON adoption expands, the different applications utilizing JSON
security services will grow and this leads to the need to support
different requirements. The WG will develop a generic syntax that can be
used by applications to secure JSON-data, but it will be up to the
application to fully specify the use of the WG's documents much the same
way S/MIME is the application of CMS to MIME-based media types.

This group is chartered to work on the following deliverables:

(1) A Standards Track document or documents representing
integrity-protected data using JSON-based data structures, including
(but not limited to) JSON data structures. "Integrity protection"
includes public-key digital signatures as well as symmetric-key MACs.

(2) A Standards Track document or documents representing encrypted data
using JSON-based data structures, including (but not limited to) JSON
data structures.

(3) A Standards Track document specifying how to encode public keys as
JSON- structured objects.

(4) A Standards Track document specifying algorithms and algorithm
identifiers for the previous three documents.

(5) A Standards Track document specifying how to encode private and
symmetric keys as JSON-structured objects. This document will build
upon the concepts and structures in (3).

(6) A Standards Track document specifying a means of protecting private
and symmetric keys via encryption. This document will build upon the
concepts and structures in (2) and (5). This document may register
additional algorithms in registries defined by (4).

(7) An Informational document detailing Use Cases and Requirements for
JSON Object Signing and Encryption (JOSE).

(8) An Informational document that tells an application what needs to be
specified in order to implement JOSE.

One or more of these goals may be combined into a single document, in
which case the concrete milestones for these goals will be satisfied by
the consolidated document(s).