Re: [Cbor] Reviews and shepherd for draft-ietf-cbor-cddl-more-control

["lgl island-resort.com" <[e-mail]>]

I’ve made a lot of progress using .join as described below, but this comment is about “.b64u” and RFC 4648 section 5.

It’s clear to me that a base64url encoder should output “-“ and “_” instead of “+” and “/“, but it’s not clear what an RFC 4648 section 5 decoder should accept. Most tools and websites I’ve played with accept both, and that’s OK. However, I was expecting .b64u to reject  “+” and “/“ because it is opinionated, but the cddl tool 0.11.4 doesn’t.

Here’s my CDDL:
    foo = text .b64u bstr

Validating “jkd8” correctly succeeds

Validating "&kd8” correctly fails.

Validating "+kd8” unexpectedly succeeds. The “+” is b64, but not b64url.

Validating "YQ==" correctly fails due to opinions about padding (that I agree with).

Interestingly, .b64c does seem to reject inputs with “_” and “-“ which aligns with my reading of RFC 4648 section 4.

I think I prefer strict enforcement because this is a validation tool. If you are picking b64url, you are probably avoiding classic for a reason.

Whatever behavior is decided upon, it would be helpful to be clear in the draft because RFC 4648 isn’t that clear and most of the tools I played with are not very organized.

LL



> On Apr 13, 2024, at 6:36 AM, Carsten Bormann <[e-mail]> wrote:
> 
> On 2024-04-11, at 15:27, Carsten Bormann <[e-mail]> wrote:
>> 
>> JWT-JWS = text .join ([
>>            b64u<jwt-headers>, ".",
>>            b64u<jwt-payload>, ".",
>>            b64u<jwt-signature>])
>> b64u<B> = text .b64u B
>> jwt-headers = text .json jwt-headermap
>> jwt-headermap = { * text => any } ; simplified
>> jwt-payload = bytes
>> jwt-signature = bytes
> 
> This proposal didn’t address the fact that .json describes a text string, but b64u<B> requires bytes.  Better:
> 
> JWT-JWS = text .join ([
>             b64u<jwt-headers>, ".",
>             b64u<jwt-payload>, ".",
>             b64u<jwt-signature>])
> b64u<B> = text .b64u B
> 
> jwt-headers = '' .cat jwt-headers1
> jwt-headers1 = text .json jwt-headermap
> jwt-headermap = { * text => any } ; simplified
> 
> jwt-payload = bytes
> jwt-signature = bytes
> 
> (This uses .cat as a conversion method between bytes and text, please see [1].)
> 
> This could be beautified some more, but does show the principle.
> 
> Grüße, Carsten
> 
> [1]: https://www.rfc-editor.org/rfc/rfc9165.html#section-2.2-2
>