GM/T 0125.2-2022JavaScript Object Notation Web cryptographic application syntax specification-Part 2:Signature (English PDF)

3.1 JOSE header

A JSON object describing cryptographic operations and parameters and consisting of a set of parameters.

3.2 JWS payload

Protected byte string message data, which refers to the data to be signed or message-authenticated by JWS.

3.3 JWS signature

A digital signature or message authentication code that provides integrity protection for the payload and protected header.

3.4 Header parameter

The "parameter name / value" pair in the JOSE header.

3.5 JWS protected header

A header parameter subject to integrity protection by the JWS digital signature or message authentication code, which is a JSON object. If it is compact serialization, the protected header is equivalent to the JOSE header.

3.6 JWS unprotected header

A JSON object that is not subject to integrity protection by the JWS digital signature or message authentication code. It only exists in the JSON serialization format.

3.7 JWS compact serialization

The serialization represented by a compact URL-safe character string used by JWS.

3.8 JWS JSON serialization

The serialization represented by a JSON-structured character string used by JWS. Unlike JWS compact serialization, JSON serialization can support unprotected header and multiple digital signatures or message authentication codes.

6.1 Overview

JWS is a data structure that uses the mode of JSON to represent the digital signature or message authentication code of message data.

JWS consists of three parts. JOSE header, JWS payload and JWS signature. JWS signature is divided into two serialization formats. compact serialization and JSON serialization. JSON serialization may include unprotected header, and it may also represent more than one signature.

6.2.1 General

The JOSE header is a JSON object. Each parameter of the JSON object describes the header parameter of JWS. The header parameter name in the JOSE header shall be unique. The JOSE header of JWS consists of the JWS protected header and the JWS unprotected header. The DER encoding rules used in this document shall comply with GB/T 16263.1.

There are three types of JWS header parameter names. defined parameter names, extended header parameter names and user-defined header parameter names.

6.2.2.6 "x5u" (certificate URL) header parameter the "x5u" header parameter is used to identify the signature certificate URL corresponding to the private key that digitally signs the JWS. Its value is a character string in the form of URI.

The resource shall provide a representation of the certificate or certificate chain in the form of PEM encoding, with each certificate separated by the following delimiters.

-----BEGIN CERTIFICATE-----

-----END CERTIFICATE-----the first certificate shall be the signature certificate of the JWS. This header parameter is optional and shall be set as the protected header parameter.

6.2.2.7 "x5c" (certificate chain) header parameter the "x5c" header parameter is used to identify the signature certificate or certificate chain that digitally signs the JWS. Its value is a JSON character string array. The elements in the array are base64 encoded character strings of the digital certificate DER encoding. The first element of the array shall be the certificate used to digitally sign the JWS, and the following elements are successively the certificates held by the CA that issues the certificate of the previous element.

This header parameter is optional.

6.2.2.8 "x5t#sm3" (certificate SM3 hash value) header parameter the "x5t#sm3" header parameter is a character string used to identify the SM3 fingerprint of the digital signature certificate, which can be used to match the key. The value generation process. use the DER encoding of the digital certificate to perform SM3 hashing, and then, base64url encoding. The calculation method and steps of the SM3 algorithm shall comply with GB/T 32905.This header parameter is optional.

6.2.2.9 "typ" (type) header parameter the "typ" header parameter is a character string that is used to identify the media type of the entire JWS. This header parameter is optional.

6.2.2.10 "cty" (content type) header parameter the "cty" header parameter is a character string that is used to identify the media type of the JWS payload. This header parameter is optional.

6.2.2.11 "crit" (crit) header parameter the "crit" header parameter is used to identify the header parameters that shall be parsed and processed. It is a JSON array that lists the names of the header parameters that shall be processed in the JOSE header. This header parameter is optional.

6.2.3 Extended header parameter names

This document can be extended to define new header parameters. To prevent conflicts, it is forbidden to duplicate newly defined header parameter names with already defined header names. New header parameters shall be introduced with caution to avoid causing non-interoperability between JWS.

6.2.4 User-defined header parameter names

The two parties of JWS application can agree on interoperable header parameter names. Unlike defined parameter names, self-defined header parameter names of different applications may conflict and shall be used with caution.

7.1 Overview

The JWS digital signature algorithm is an algorithm used to digitally sign message data. The algorithm is identified by the "alg" header parameter of the JOSE header, and the identifier value shall comply with GM/T 0125.1.

This document specifies the implementation requirements for the SM2 digital signature algorithm. The value of the JWS signature is the digital signature result.

7.2 SM2 Digital Signature Algorithm

This section describes the relevant requirements for the SM2 digital signature algorithm.

The signature verification method of the SM2 digital signature algorithm shall comply with GB/T 32918, and the specified hash algorithm shall be the SM3 algorithm. The operation method and steps of the SM3 algorithm shall comply with GB/T 32905.

The output result of the digital signature of this algorithm shall comply with GB/T 35276, and the encoding rule shall use DER encoding and shall comply with GB/T 16263.1.

8.1 Overview

The JWS message authentication algorithm is an algorithm that provides integrity protection for message data. The algorithm is identified by the "alg" header parameter of the JOSE header, and the identifier value shall comply with GM/T 0125.1.

This document specifies the implementation requirements for the message authentication algorithm based on SM3.The value of the JWS signature is the output result of the message authentication algorithm.

8.2 Message Authentication Algorithm Based on SM3 Algorithm

This section describes the relevant requirements for the message authentication algorithm based on SM3 algorithm.

The calculation process and results of the message authentication algorithm shall comply with GB/T 15852.2, adopt MAC algorithm 2, and specify the hash algorithm as SM3 algorithm. The operation method and steps of SM3 hash algorithm shall comply with GB/T 32905.

The output result of the algorithm is the HMAC value of the message authentication algorithm, and the output length is 256 bits.

9.1 Overview

This section describes the generation and verification process of JWS digital signature and message authentication code.

9.2 Generation Process

Set the message data M as the payload.

The calculation steps are as follows.

a) Calculate the payload encoding as base64url(M);

b) In accordance with the protected header parameters set by the application, generate the JSON structure of the protected header;

c) If it is JWS JSON serialization, in accordance with the unprotected header parameters set by the application, generate the JSON structure of the unprotected header;

d) In accordance with the digital signature algorithm or message authentication algorithm used, follow GM/T 0125.1 and set the "alg" header parameter value in the JOSE header;

e) If user key information needs to be set, set the relevant data in the JOSE header;

f) The character string of the protected header JSON structure is encoded using UTF-8, and the protection header encoding is calculated as base64url (UTF8 (protected header));

g) Calculate the data to be signed or message authenticated M = ASCII (protected header encoding||'.'||payload encoding);

h) In accordance with the requirements for the JWS digital signature or JWS message authentication algorithm, based on the data M, calculate the JWS signature, and generate the signature encoding as base64url (JWS signature);

i) If using JWS JSON sterilization, repeat this process for each digital signature or message authentication code operation [steps c) ~ h)];

j) Output sterilization data.

1) If it is compact serialization, the output is (protected header encoding||'.'|| payload encoding||'.'||signature encoding);

2) If it is JSON serialization, the output result is shown in 12.3.

For examples of message signature and message authentication code calculation, see Appendix A.

9.3 Verification Process

The process of verifying whether JWS is valid is as follows.

a) In accordance with 12.3, parse the JWS serialization data.

b) If it is compact serialization, through the delimiter '.', parse the protected header encoding, payload encoding and signature encoding. If the parsing fails, the verification fails.

c) If it is JSON serialization, parse the JSON structure to obtain payload encoding, one or more protected header encoding, signature encoding and unprotected header.

d) Check whether the payload encoding is successfully decoded by base64url. If it fails, then, the verification fails.

e) Check whether the protected header encoding is successfully decoded by base64url and whether the decoded data complies with the UTF-8 encoding rules. If it fails, then, the verification fails.

f) Check whether the signature encoding is successfully decoded by base64url. If it fails, then, the verification fails.

g) If it is compact serialization, set the JOSE header to the protected header.

h) If it is JSON serialization, set the JOSE header of each signer as the union set of the protected header and the unprotected header.

i) Check whether there are repeated header parameters in the JOSE header. If there are repeated header parameters, the verification fails.

j) Check the JOSE header parameter. If there is a "crit" (critical) header parameter value, then, the corresponding processing shall be performed in accordance with the parameter value definition.

k) Match the user key or identifier information of the digital signature or message authentication code.

l) Check the "alg" header parameter of the JOSE header. If it does not exist or the identified algorithm does not support it, then, the verification fails.

m) Set the signature original data M = ASCII (protected header encoding||'.'||payload encoding), and the JWS signature is the value decoded by the signature encoding base64url. In accordance with the "alg" header parameter of the JOSE header, identify the corresponding algorithm. In accordance with the algorithm, verify the digital signature or message authentication code. If the signature or message authentication code verification fails, then, the verification fails.

n) If multiple signers need to be verified, repeat steps e) ~ m).

o) Output verification success.