Adding JSS signature

The current described “use of digital signatures” in Annex I uses the “detached content” method as described in Annex F of RFC 7515. This method assumes that the recipient can construct the exact payload as was used in the creation of the JWS signature. Since JSON doesn’t require object properties to be in any specific order and JSON also describes multiple ways of representing the same data, this may cause problems when verifying JWS signatures. This CR introduces an additional JSON Signature Scheme that ensures that recipients can perform verification of received signed data more reliably.

Merge request reports

Loading