Re: [Cbor] Use-Cases for Determinism

["lgl island-resort.com" <[e-mail]>]

On Aug 23, 2023, at 12:38 PM, Anders Rundgren <[e-mail]<mailto:[e-mail]>> wrote:

On 2023-08-23 20:54, lgl island-resort.com<http://island-resort.com> wrote:
Heya,

Hi Laurence,
What you are saying about signatures is technically correct but only works if you have direct connection to the input buffer.

In OO based encoder/decoders systems like CBOR.js, CBOR data items are "by design" converted into immutable self-contained objects.
This makes it possible to "compose" data to be signed.
For such systems, deterministic encoding (or like it is currently done with JSON, canonicalized encoding) is more or less a prerequisite.

Makes sense and is really helpful to know. I’ve looked at enough Python and Java code to understand what you are talking about and I can see how determinism enables a lot of new use of CBOR in environments like those.

I wouldn’t say this is strictly about OO as lots of OO use and environments don’t have this characteristic.

Would it be correct to characterize this way?

In some programming environments, particularly OO, an object can have a method to serialize itself using a particular serializer. It is really helpful if the same serializer in different programming environments works exactly the same way when the data is to be signed or hashed.

In a way this is more about standardization of programming environments than it is about bits on the wire. IETF doesn’t usually do this, but it seems sensible here.

LL