Signed messages

[cyberphone]

When/If you add signatures to the plot you effectively have two options:

• Following the Open Banking UK API shrouding the business data in Base64Url through JWS/JWT
• Add a non-intrusive clear text JSON signature based on the same cryptography and attributes as JWS

Open Banking API:

eyJhbGciOiJSUzI1NiIsImtpZCI6ImsyYmRjIn0.ew0KICJpc3MiOiA
(... abbreviated for brevity ...)
zCYIb_NMXvtTIVc1jpspnTSD7xMbpL-2QgwUsAlMGzw

Revolut API enhanced with a clear text JSON signature:

{
    "id": "df8d6b20-0725-482e-a29e-fb09631480cf",
    "name": "EUR expenses account",
    "balance": 1234,
    "currency": "EUR",
    "state": "active",
    "public": false,
    "created_at": "2017-06-01T11:11:11.1Z",
    "updated_at": "2017-06-01T11:11:11.1Z",
    "signature": {
        "alg": "ES256",
        "jwk": {
            "kty": "EC",
            "crv": "P-256",
            "x": "PxlJQu9Q6dOvM4LKoZUh2XIe9-pdcLkvKfBfQk11Sb0",
            "y": "6IDquxrbdq5ABe4-HQ78_dhM6eEBUbvDtdqK31YfRP8"
        },
        "val": "l_T4fBndK10QNBg7dIx7YGpUtWu9KlyvJ5mpjrO4BfLgP9tfR6_hnBtv9zf-KbKNEK53tBcGMU0Ts-1GN13_Iw"
    }
}

https://mobilepki.org/jose-jcs https://tools.ietf.org/html/draft-rundgren-json-canonicalization-scheme-00

[joejordanbrown]

This is needed!