JSON Signature

2019

In Chapter 7, we discussed in detail the JWT (JSON Web Token) and JWS (JSON Web Signature) specifications. Both of these specifications are developed under the IETF JOSE working group. This chapter focuses on another prominent standard developed by the same IETF working group for encrypting messages (not necessarily JSON payloads): JSON Web Encryption (JWE). Like in JWS, JWT is the foundation for JWE. The JWE specification standardizes the way to represent an encrypted content in a JSON-based data structure. The JWE 1 specification defines two serialized forms to represent the encrypted payload: the JWE compact serialization and JWE JSON serialization. Both of these two serialization techniques are discussed in detail in the sections to follow. Like in JWS, the message to be encrypted using JWE standard need not be a JSON payload, it can be any content. The term JWE token is used to refer to the serialized form of an encrypted message (any message, not just JSON), following any of the serialization techniques defined in the JWE specification.

2015

XML is spreading quickly as a format for electronic documents and messages. As a consequence, greater importance is being placed on the XML security technology. Against this background research and development efforts into XML security are being energetically pursued. This paper discusses the W3C XML Signature and XML Encryption specifications, which represent the fundamental technology of XML security, as well as other related technologies originally developed by NEC. Web Service Transactions are done mainly through plain-text XML formats like SOAP and WSDL, hence hacking them is not a tedious task. XML Signature and XML Encryption ensure security to XML documents as well as retain the structure of the documents, thereby making it easy to implement them. These two methods are evaluated on the parameters of authentication, authorization, integration, confidentiality and non-repudiation.

2016

This paper will compare the XML RPC and OPTIMIZED JSON which are two data interchange formats currently used by industry applications. We need to opt for an appropriate data interchange format which can cause notable impact on the rate at which data is transmitted and its performance. Firstly, we will explain the specific languages and their use. Further then study is conducted to do the comparison of utilized resources and performance of various applications that use the data interchange formats. We find that OPTIMIZED JSON is much faster than XML and design the metrics related to resources for our results.

2003

XML's popularity in the last few years has made this markup language a de facto standard for the web data interchange. DTD's (or Schemas) definition associated with XML documents introduces data modelling in XML's world, allowing the specification of a hierarchy of concepts or elements that constitute the XML document. Taking into account that the purpose of these data models is the highly structured information exchange among several systems, it is required to incorporate security mechanisms that allow a secure interchange. The World Wide Web Consortium (W3C) is working in the recommendations of several XML security standards. Between them, we emphasize in the XML-Signature Syntax and Processing, which allows the insertion and information processing of authentication and digital signature. Once the XML security standards have been approved as recommendations, the following step will be to include them completely or just certain parts in future or new versions of the DTD's or existing Schemas, but at present many DTD's exists that do not consider these security components within their definition. This is the case of the NewsML DTD, standard for the press news electronic interchange. The XML security standards are characterized by high flexibility and extensibility, because of that it is necessary to make an exhaustive study of the domain where it is intended to be applied and define a specific application upon the domain DTD or Schema. What we propose in this paper is a way to include information of authentication and digital signature in the NewsML DTD. In order to indicate a possible application, we carry on a joint study of XML-Signature Syntax and Processing and NewsML, analysing in what elements and how authentication and digital signature might be included.

Journal of Engineering Research and Sciences, 2022

JavaScript Object Notation (JSON) is an open standard data format that is used widely across the internet as means of exchanging structured data due to its low overhead. While originally created in the early 2000s, it has only gained standard status in 2013 and then again in 2017 with a new version that focused more on security and interoperability. In this paper the authors present a different specification of the JSON standard that relies on algebraic formal methods and provides certain benefits over a regular natural language specification. This specification can also function as a schema that can attest a JSON data document's compliance to its blueprint. The absorption of Formal Specification methods by the industry happens at a very slow pace, mostly because there is little incentive to tread into a fairly unknown territory. Notwithstanding this reluctance, the authors encourage the usage of Formal Specification techniques to the specifications of open standards; Formal specifications are more succinct, less ambivalent, consistent to the standard, reusable as they support module inheritance and can be executable. The process of designing new Standards can benefit from Formal Specifications as the resulting specification i) is more tangible; ii) allows a thorough and clear understanding of the standard and also iii) allows property checking and property verification.

2016

With the development of information technology, computer has played more and more important role in many regions and human’s life. The number of computer and network users is increasing minutes by minutes which make this global network and its information expanding rapidly day by day. Meanwhile, the modern computerized information system has been developed rapidly and implemented in many regions, such as education regions, enterprise and provides an electronic means to access information and data. As the fast development of computerized system, the W3C group has developed a flexible language named XML. The W3C has deemed the Extensible Markup Language (XML) will form the important basis for the information interchange and accessing in the field of computer network. It will make the electronic exchange of documents and other exchangeable information much easier, convenient and less expensive. At the same time, the security requirement (e.g. integrity, authenticity of the information ...

International Journal of Advanced Computer Science and Applications

Data exchange between different devices and applications has become a necessity nowadays. Data is no longer stored locally on the device, but in the cloud. In order to communicate with the cloud and exchange data, web services are being used. To keep the communication consistent across different devices and platforms, the data needs to be formatted using a standard data format, such as JSON or XML. This paper compares both standards and provides an in depth analysis of their performance. In order to perform the analysis a web API was built in the PHP framework Laravel, which was then tested with the help of the API development environment called Postman for different number of transferred items.

Proceedings of the International Conference on Security and Cryptography, 2006

Security technologies for XML, the XML Encryption and the XML Signature developed by the World Wide Web Consortium, will play a vital role in security on the Internet. A binary X.509 certificate encoded in ASN.1 is included in the XML Signature. We propose to extend the XML Signature to fully represent X.509 certificate information in XML. We developed the specifications for extensions. We implemented a converter that transforms between the ASN.1 representation and XML representation of an X.509 certificate that was aimed to verify the validity of our proposal. World Wide Web security is an important issue on the Internet and trusted information is critical. We experimented with Web page signing, applying the extended XML Signature. We propose the scheme for signed Web pages based on the XML Signature. We conducted a test implementation of the scheme with the extended XML Signature. We verified that the proposed scheme could easily be implemented and incorporated into the current Web environment as well as the effectiveness of the extended XML Signature. The paper concludes by identifying necessary areas for future standardization.

2013 International Conference on Recent Trends in Information Technology (ICRTIT), 2013

In this paper, we present a survey of the state of the art in XML XML security. This survey will support the future research and development work as well as to raise the awareness for the presented approaches. In this survey, we present the different articles that describe the XML security standards specifically XML encryption, XML signature, and XACML, and we introduce the different approaches for access control for XML documents. This survey will support the future research and development work as well as to raise the awareness for the presented approaches.

2010

Prior art in the expression of digital rights using XML is demonstrated to require a process of interpretation or parsing, as is characteristic with language processing, and in addition to be subject to the cross-domain scripting problem. The expression of digital rights using JSON, however, represents a novel approach, bypassing the need for language processing, and in addition, solving the cross-domain scripting problem.