Detached signatures

[unilynx]

Siging JWS with detached payload

For iDEAL 2.0 I need to generate a JWS signature header with a detached payload. Is there a clean way to generate this?

I'm trying to use new jose.CompactSign(body).setProtectedHeader(…).sign but I'm not seeing an option to clear the payload in SignOptions.

Right now I'm using

  const [header, , hash] = signature.split('.');
  const detachedsignature = `${header}..${hash}`;

on the result which works fine, but it would be nice to support it in the library itself.

[panva]

You can either do what you're doing with CompactSign and string manipulation, or do FlattenedSign and work with a flattened format object output by the library.

Either way is okay and doesn't need anything in the library per se.

https://datatracker.ietf.org/doc/html/rfc7515#appendix-F

[unilynx]

To be honest, I don't find the appendix F particularly clear if you don't know how JWSes are constructed. I think for a library that helps with JWT and JWS construction (And I'm grateful such libraries exists!) it would be useful to add his as an option as other specs that refer to JWS require it, and not assuming library users will be comfortable looking up page 57 in a RFC.

It's fine with me either way, it's fixed for me, but it did take some back and forth to be sure I was on the right path ("are we sure this is what they mean?" "am I overlooking something, as Jose does seem to support detached payloads when verifying?")

(It also doesn't help here that the Ideal specs themselves are pretty light on details too, and have no examples of how such a signature actually would look, but that's not Jose's fault)

[panva]

Fair enough. I'll take a stab at adding a function in the Sign prototypes to detach the payload from the resulting JWS.