Finalize the data formats

[callahad]

Goal

BrowserID's data formats should align with the specifications from the IETF's JavaScript Object Signing and Encryption (JOSE) and Web Authorization Protocol (oauth) Working Groups to minimize fragmentation and foster interoperability with future tools and libraries.

Define

• [ ] Answer unresolved questions, updating task list and spec as appropriate.
  • [ ] Decide on which algorithms to support (JWA).
  • [ ] Is there any IETF-equivalent of our Backed Identity Assertions, which look like two JWTs joined by a ~?
• [ ] Define the data formats
  • [ ] Public and private key formats (JWK)
  • [ ] Well-known document format (custom)
  • [ ] Format for listing multiple public keys ("JWK Set")
  • [ ] Identity Certificate (JWT)
  • [ ] Identity Assertion (JWT)
  • [ ] Backed Identity Assertion (custom?)
• [ ] Ensure that the version of each JOSE draft is explicitly stated and that the repository contains copies of those drafts. This will cover, at minimum: JWA, JWK, JWS, and JWT.

  Implement

• [ ] Fully implement the new formats in:
  • [ ] mozilla/browserid
  • [ ] Client-side
  • [ ] Verifier
  • [ ] mozilla/jwcrypto

    Validate

• [ ] Ensure that the prior data formats still work as expected.
• [ ] Port eyedee.me
• [ ] Port mockmyid.com
• [ ] Port login.mozilla.org

  Finish

• [ ] Update MDN.
• [ ] Blog about new data formats.
• [ ] Deprecate prior data formats by notifying persona-notices and dev-identity.

[fmarier]

As part of this work, we should specify the email address format we use and make sure we check it everywhere. This has security implications.

[djc]

Is there value in making a very explicit list of things that change? That seems to not be mentioned here, yet.

Since some of the changes in the JWS area are quite subtle, this would make a useful resource.