Show HN: Coze – cryptographic JSON messaging specification

8 points

3 years ago

Coze is open source under the BSD 3 license, and the reference implementation is written in Go.

You can play with Coze using the online tool (https://cyphr.me/coze). There is also the simple tool (https://cyphr.me/coze_verifier_simple/coze.html).

This is an example coze:

    {
        "pay": {
            "msg": "Coze Rocks",
            "alg": "ES256",
            "iat": 1623132000,
            "tmb": "cLj8vsYtMBwYkzoFVZHBZo6SNL8wSdCIjCKAwXNuhOk",
            "typ": "cyphr.me/msg"
        },
        "sig": "Jl8Kt4nznAf0LGgO5yn_9HkGdY3ulvjg-NyRGzlmJzhncbTkFFn9jrwIwGoRAQYhjc88wmwFNH5u_rO56USo_w"
    }

Coze also defines a key format allowing cryptographic keys to be represented completely in JSON:

    {
        "alg":"ES256",
        "iat":1623132000,
        "kid":"Zami's Majuscule Key.",
        "tmb":"cLj8vsYtMBwYkzoFVZHBZo6SNL8wSdCIjCKAwXNuhOk",
        "x":"2nTOaFVm2QLxmUO_SjgyscVHBtvHEfo2rq65MvgNRjORojq39Haq9rXNxvXxwba_Xj0F5vZibJR3isBdOWbo5g"
    }

We've also published a Javascript implementation of Coze and a CLI library. https://github.com/Cyphrme/CozeJS https://github.com/Cyphrme/CozeCLI

We hope you enjoy!

# What is Coze useful for?

Coze can be used for anything needing cryptographic signing, such as IoT, authentication, sessions, and cookies.

As a timely example, reddit.com/u/spez, the CEO of Reddit, edited people's comments on Reddit. (https://www.theverge.com/2016/11/23/13739026/reddit-ceo-stev...) Coze stops that as cozies are impossible to edit by third parties.