OpenC2 TC,
This is my first time using this method, I hope it works as intended. Since my organization is temporarily no longer a member of Oasis I am using this method to make suggestions.
Enclosed I have attached my "rough" suggestion for a signature scheme in OpenC2 in relation to LSC issue #363. The general suggestion involves detaching and attaching a signature field to a pre-made OpenC2 payload encompassing headers and content as suggested by Dave Kemp in issue #353.
Since the particular way in which a signature is applied is serialization dependent I suggest that we use best practices for each serialization and define what those are for OpenC2. In this case I utilized JSON serialization as an example. The RFCs (JWS and JCS) referenced as best practice will be specific to JSON serialization only.
PS: I know it needs a little something, but perhaps this will start that conversation.
V/R
Danny Martinez
Principal Cyber Security Engineer
HII Mission Driven Innovative Solutions (HII-MDIS)
Technical Solutions Division
302 Sentinel Drive, Suite 300 | Annapolis Junction, MD 20701
Mobile (407)
257-0031
Confidentiality Statement: HUNTINGTON INGALLS INDUSTRIES PROPRIETARY - This e-mail contains information proprietary or private to Huntington Ingalls Industries, Inc., and is not to be disclosed to, copied by, or used in any manner by others without the prior express, written permission. If you are not the intended recipient, please delete without copying and kindly advise the sender by e-mail of the mistake in delivery.