Re: [apps-discuss] Kathleen Moriarty's Discuss on draft-ietf-appsawg-json-merge-patch-06: (with DISCUSS)

On Wed, Aug 20, 2014 at 10:00 PM, James M Snell <jasnell@gmail.com> wrote:

>
> On Aug 20, 2014 6:50 PM, "Paul Hoffman" <paul.hoffman@vpnc.org> wrote:
> >
> [Snip]
>
> >
> > I'm not sure I can add those sentences in a useful fashion. With current
> delivery mechanisms (HTTP being the most common), MIME objects don't come
> with hashes for checking. So giving that advice would cause developers to
> look for something that they won't have, namely hashes of the MIME object
> they just got.
> >
>
> +1
>
> > I do hope you're not asking us to change the format to include an
> internal hash. That would require inventing JSON canonicalization (which
> the JOSE WG has flailed miserably on) and say "canonicalize, pick a hash
> function, hash, and add that to the patch object". The recipient would need
> to pull the hash out before processing the patch, canonicalize the result,
> and check the hash. This is conceptually possible but it seems onerous, and
> has not been done in any of the earlier patch formats that have been
> standardized in the IETF.
> >
>
> +1... Adding an internal hash would not work with this mechanism without
> taking a major step backwards. I do not see the value.
>
Not to worry, I wasn't asking for anything to be added other than text in
the security considerations for when it was possible, keying off of your
first response, "The document explicitly shows how to do this for any
MIME-aware transport. Some of those might come with hashes that the
recipient are expected to check, but most of the common ones today are
not."  Obviously, it would not be something required since it doesn't
always get delivered, but I don't see a reason to exclude mention of this
practice when it provides additional integrity checking when it is
available.

I guess I find it odd that this has not been done before, so I'm guessing
there has not been security issues yet that caused an update in practices?

Thanks.

> - James
>
> > --Paul Hoffman
> > _______________________________________________
> > apps-discuss mailing list
> > apps-discuss@ietf.org
> > https://www.ietf.org/mailman/listinfo/apps-discuss
>

-- 

Best regards,
Kathleen