Choose a more specific name than "signing-spec"

[secure-systems-lab]

Choose a more specific name than "signing-spec"

[MarkLodato]

tamale: Type And Message Authenticated in a Lightweight Envelope

[adityasaky]

It's probably past time to kickstart this. Does anyone have any thoughts on what we can name this spec? Any initial leads we could iterate over?

[TomHennen]

Some random thoughts:

JSON Artifact Envelope - JAE - Not great because it's not actually an envelope for artifacts.
involucrum - Latin for envelope. Using Latin to play off of in-toto. Probably pretty awkward to say.
JSON Signed Envelope - JSE
in-toto Attestation Envelope - IAE (maybe we don't want to reference in-toto?)

[MarkLodato]

More ideas:

• "envelope" or "signature" in another language.
• "Foolproof Signed Envelope"
• "Dead Simple Signed Envelope", pronounced "dissy"

Edit: or use "message" instead of "envelope"

[adityasaky]

I like Dead Simple Signed Envelope! I was considering options along the lines of "Lightweight", but I think this may be crisper.

[MarkLodato]

Another option that is more descriptive:

• "Signed Type-Identified Message" (STIM)
• "Signed Message with Authenticated Type" (SMAT)
• or similar

If we think about the advantages of this spec over others, the main thing is that it authenticates the type in addition to the message. The only other spec that provides that is JWS (via typ), but that spec is super complicated and error-prone.

[TomHennen]

Type Authenticated Cryptographic Object - TACO

🌮

[MarkLodato]

Oh man, I love it! Too bad the name is overly broad!

[trishankatdatadog]

I vote DSSE

[MarkLodato]

I have a slight preference for tamale but am fine with DSSE.

Any more votes?

I suggest that we go with DSSE unless we hear any dissenting opinions within the next few days.

[TomHennen]

I'm fine with either.

…

On Fri, Jun 4, 2021 at 11:18 AM Mark Lodato ***@***.***> wrote: I have a slight preference for tamale but am fine with DSSE. Any more votes? I suggest that we go with DSSE unless we hear any dissenting opinions within the next few days. — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#16 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABHZSMEW6NY3FLAEZHD3UWDTRDVDLANCNFSM4XCSYKSA> .

[adityasaky]

I'm fine with either as well.