Re: [Acme] ACME signature mechanics

[Nico Williams <[e-mail]>]

On Wed, Dec 17, 2014 at 05:53:39AM +0100, Anders Rundgren wrote:
> On 2014-12-16 17:27, Richard Barnes wrote:
> >I think there might be a middle way here.  I've been musing about
> >making a "Content-Signature" header that just carries a JWS signature
> >over the payload (no HTTP headers).  Since HTTP has to carry the
> >payload bit-exact, there's no c14n nonsense, so this could be much
> >simpler than other HTTP signing proposals.  It's sort of like JCS,
> >except that there is actually a guarantee that the payload stays the
> >same ;)
> 
> [...]
> 
> BTW, JCS does not depend on any c14n nonsense; it only requires that
> JSON property order is respected by the serializer/deserializer while
> whitespace is entirely insignificant.  You can even verify
> pretty-printed signatures!

You lost me.  If whitespace is insignificant, then you must be
canonicalizing.  Also, I assume you mean object name order by "property
order", but this is not required to be preserved by JSON parsers.

> >That said, if your concern is really human readability, I don't think
> >it's a tragedy to make someone copy/paste into a base64 decoder.

I don't either.

Nico
--