Mozilla Persona sign data string

43 views Asked by At

Is it possible to use Mozilla Persona to sign data (string, token, ...)?

I would like to pass a string of data with the navigator.id.request(), then transfer the assertion on an un-trusted medium and retrieve the data upon verifying.

1

There are 1 answers

1
frasertweedale On BEST ANSWER

Persona/BrowserID is not a general-puropse signature scheme. For that, you might want to look at JSON Web Signature (JWS), for which there is library support in many languages.

The navigator.id.request API does not provide a way to pass arbitrary data into the provisioning workflow, so the standard Persona JavaScript would not be able to accomplish this. You would have to use customised JavaScript that provides the provisioning callback with custom data rather than a public key object.

If you get this far, whether you can get the identity provider to sign arbitrary data will depend on how the IdP software treats the public key argument. For example, the Haskell persona library treats the public key argument opaquely; it will certify any arbitrary JSON 'Value' (see source).

On the other hand, if the IdP software expects to parse a valid key object in the format generated by the JavaScript mediator code, then you will not be able to sign arbitrary data.

In conclusion: if you host customised JavaScript to pass arbitrary data to the IdP rather than a public key, and if the IdP's software treats the public key as an opaque value, then you can sign arbitrary data with Persona.