Re: [dispatch] PING2. Re: JSON Canonicalization Standard

[Anders Rundgren <[e-mail]>]

On 2018-09-07 22:40, Brian Campbell wrote:
> XML Canonicalization and Signatures are notoriously brittle and difficult to 
> get right while also being the source of numerous serious security vulnerabilities.
> The JSON case is maybe simpler and thus somewhat less prone to the same issues but, 
> if history is any guide, it's really hard to get right and is fertile ground for all kinds of attacks.

This I've been told numerous of times.  I'm still waiting for a concrete example [*] of what could possibly be a problem.

Having worked pretty extensively with both variants I can attest that there is at least a factor 10 difference in code size due to the absence of schema, name-spaces and defaults.  I believe the quite complex WS security frameworks also were a source of interoperability issues with XML.

The only thing that (undeniable) is non-trivial is serialization of the JSON Number type.  Fortunately, the scheme defined by EMCAScript and supported by several open source implementations made even this part simple.  I performed a fully verified port to C# in just a couple of days.

FWIW, a "companion I-D" was recently published: https://tools.ietf.org/html/draft-erdtman-jose-cleartext-jws-01

Anders

*] https://cyberphone.github.io/doc/security/jwsvariants.pdf