Re: [apps-discuss] CBOR: convert CBOR bignum to base64url JSON string

[Carsten Bormann <[e-mail]>]

On May 24, 2013, at 02:33, "Manger, James H" <[e-mail]> wrote:

> A minor (non-controversial?) suggested change for draft-bormann-cbor:
> 
> Section 4.1. "Converting From CBOR to JSON" 11th dot point says:
> 
>  o  A bignum (major type 7, tag value 8 or 9) becomes a JSON number.
> 
> This might be right in theory, but I don't think it is in practice.
> Presumably a bignum was used because the value (or other expected value for the same field) is too large for normal (32-bit, 64-bit) number types, which are the types many implementations use represent a JSON number. Hence they will fail with a bignum.

That is a very good point.
I haven't done a survey of JSON implementations how they handle large numbers that look like integers.
Of those for platforms that don't have bignums, I would expect many of them to create a double-precision float for large numbers.  
This doesn't fail, but loses precision.

> I suggest converting a bignum to a base64url encoding (without padding) in a JSON string. This is what you get if the positive bignum tag was ignored and you just processed the byte string that followed. For a negative bignum stick "-" before the base64url encoding.

That is certainly good advice if the bignum was, say, a value from an ECDSA signature, where losing precision destroys the utility.
Less so if it was the US national debt (well, for a few more weeks, that will still fit in a 64-bit number :-).

Right now we have limited experience what people would be using bignums for in a JSON-interfacing application.
The conversion rules we set up will shape that usage, so for me the question really is what usage of bignums do we want to encourage.
(E.g., I think it would have been a mistake to put that ECDSA signature value in a bignum in the first place.  
But X9.62 did exactly this, in ASN.1, which doesn't even have unsigned numbers.)
Outside of JSON-interfacing applications, the area of application of bignums is much clearer.

BTW, the "-" convention you propose doesn't work very well with base64url.
(This is the first example I've seen in a long while where base64 would actually work better than base64url.)
But given the semantics of the byte string in CBOR, it should be a "~" anyway, and that is free in base64url.

So how would you plan to use bignums in JSON-interfacing CBOR applications?  For crypto material like ECDSA values?

Grüße, Carsten