Re: [jose] Canonical JSON form

Bret Jordan <jordan.ietf@gmail.com> Thu, 11 October 2018 17:24 UTC

Return-Path: <jordan.ietf@gmail.com>
X-Original-To: jose@ietfa.amsl.com
Delivered-To: jose@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0E3B1130EBB for <jose@ietfa.amsl.com>; Thu, 11 Oct 2018 10:24:09 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.998
X-Spam-Level:
X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VioQR0dq7QeV for <jose@ietfa.amsl.com>; Thu, 11 Oct 2018 10:24:06 -0700 (PDT)
Received: from mail-io1-xd2c.google.com (mail-io1-xd2c.google.com [IPv6:2607:f8b0:4864:20::d2c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 25A1A130EB9 for <jose@ietf.org>; Thu, 11 Oct 2018 10:24:06 -0700 (PDT)
Received: by mail-io1-xd2c.google.com with SMTP id q4-v6so7208519iob.8 for <jose@ietf.org>; Thu, 11 Oct 2018 10:24:06 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=2A2B2u0pfIYEqkRog7irUjKnP0qt0BzXGp9bUhQL2K0=; b=XxYcVy03wGW+7ZQqvuAzpZ/+csqMzmsdwJP5k1ZfAwE8ulHWSpPKXc7riNQ/9hmoVy g7d275TNOBAgdxTe5Ha8IuNdtL9+MsQnqmko/mBfgtnYdzbaTTW0UGuLSJ52vkc9ouMq mDF/Y0Iem1Fuoct3ScRHeTAM/0JO22NcNBvocgdvq8Lw6MOh6zfVWMObNKap/qCbDkPu ExA2dLvWcaj2Y7a/az/e/F8WG8OVp2eTAwnTKaBeu28sA3hr67FhLvoCAAQw0FgFSdaj JsqY7gi3goSlWafR/bugNYhxxou89+r6AaHptgEYPtFQNCQ6QitR/KfxeqH4pJPyttkF U0ug==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=2A2B2u0pfIYEqkRog7irUjKnP0qt0BzXGp9bUhQL2K0=; b=HK/jfCZldYhkwQKu0j7vNsE+gtRuMTTXctAIaN9bwqRNfOVRIwBO5dAb46ktMJDEt6 xUIiOtU8Zh3Joq1BYOTp8X7J96uPN2ZLwkZlRbzS4uhbrXqVHeCv7b2jjhO90VBYpuxj 0lZWhh69YstVeotleZzsp6ZoiJj8xy+qvDC52USK3ygd2+Nvnl4LYDLXiEuXxAFgr6Zt 8FCdkkIMmbWrKnM6VdPQMajRCOFQGpgzsO0tR5C2DUFB2hH/mscAV070crX04YyJdhW5 r9qZx+4H9I4kNGr6QOFkAZ5vubuH5qZpTrrwz7YSdD+5HTxMgKWLvJ9dQ9ZFE8Sjgk51 yXIQ==
X-Gm-Message-State: ABuFfog5GAV1pcUZsyAX5KRXai5CcxYIulkVBShrktKRvT8dzume2fy6 LzqvsWgLTbZPCl9gXeejJb4=
X-Google-Smtp-Source: ACcGV61ICrwGJ3YZ/mro9hpJH9Ur9udJACDLI/gpef6G0b+sFP20XD9lu3Y84M2KEOyp4W7gEymOjg==
X-Received: by 2002:a6b:1885:: with SMTP id 127-v6mr1652985ioy.263.1539278645423; Thu, 11 Oct 2018 10:24:05 -0700 (PDT)
Received: from [172.16.255.50] ([216.194.115.4]) by smtp.gmail.com with ESMTPSA id b20-v6sm3472730iob.26.2018.10.11.10.24.03 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 11 Oct 2018 10:24:04 -0700 (PDT)
From: Bret Jordan <jordan.ietf@gmail.com>
Message-Id: <0E6BD488-74D5-4640-BC31-5E45B0531AFC@gmail.com>
Content-Type: multipart/alternative; boundary="Apple-Mail=_217078F6-C741-40A0-B0B0-CD51DE0FAD33"
Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\))
Date: Thu, 11 Oct 2018 11:23:56 -0600
In-Reply-To: <CAHbuEH6DCD7Zc+PK3TnCBkKv1esnROwyCcDb8ZR+TKwgQQ+yXQ@mail.gmail.com>
Cc: "Manger, James" <James.H.Manger@team.telstra.com>, jose@ietf.org
To: Kathleen Moriarty <kathleen.moriarty.ietf@gmail.com>
References: <12DD2F97-80C3-4606-9C6B-03F7A4BF19DE@gmail.com> <CAOASepNX4aYVmPWXyODn0E2Om_rimACPECqJBvZSOXVVd_p8LA@mail.gmail.com> <D21F3A95-0085-4DB7-A882-3496CC091B34@gmail.com> <CAOASepM=hB_k7Syqw4+b7L2vd6E_J0DSAAW0mHYdLExBZ6VBuw@mail.gmail.com> <00ad01d460f4$69ae8a00$3d0b9e00$@augustcellars.com> <8436AEE7-B25A-4538-B8F6-16D558D9A504@gmail.com> <MEAPR01MB35428606C09BF315DE04CC79E5E10@MEAPR01MB3542.ausprd01.prod.outlook.com> <CAHbuEH6DCD7Zc+PK3TnCBkKv1esnROwyCcDb8ZR+TKwgQQ+yXQ@mail.gmail.com>
X-Mailer: Apple Mail (2.3445.9.1)
Archived-At: <https://mailarchive.ietf.org/arch/msg/jose/CaXmrK1sPMHDhqGcr-J7OfyihRw>
Subject: Re: [jose] Canonical JSON form
X-BeenThere: jose@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Javascript Object Signing and Encryption <jose.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/jose>, <mailto:jose-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/jose/>
List-Post: <mailto:jose@ietf.org>
List-Help: <mailto:jose-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/jose>, <mailto:jose-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 11 Oct 2018 17:24:09 -0000

Kathleen,

From your comments I take it is okay then to do a draft proposal in another WG and then have this mailing list review it?  Would we then restart JOSE if the draft was good to have it standardized in JOSE or just some other WG?  

I just want to be sensitive to the work that has already been done and build on it.  I also do not want to do things that are “bad form”.  We are all in this boat together, and I just want to work with everyone to row in the same direction.

BTW, I have spoken with a few other vendors and service providers and they are also very interested in this work as it would solve a lot of problems they have or are seeing. 

Thanks,
Bret
PGP Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 0050
"Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg."

> On Oct 10, 2018, at 7:47 PM, Kathleen Moriarty <kathleen.moriarty.ietf@gmail.com> wrote:
> 
> Bret,
> 
> You could define it within a draft in a different working group other than JOSE and ask for reviewers from JOSE to review and comment to catch problems.  Although already described above, there are issues with this and JSON, which is why the WG didn't want to do canonicalization.
> 
> I'm assuming you want to do basically what was done for RID in XML using JSON.  You may want to look at the set of possibilities to replicate as they are all likely needed with what you are trying to do or just as part of your gap analysis.
> 
> https://tools.ietf.org/html/rfc6545#section-9.1 <https://tools.ietf.org/html/rfc6545#section-9.1>
> Also look at 9.3.1 and 9.3.2 as you're likely to also need multi-hop authentication too.
> 
> To David's point in the message that follows this (came in while typing), RID signed portions of the message to enable interoperability and you are likely to need to do very similar things that are described in RID related to the policy work I had previously mentioned for your gap analysis as being similar functionality.  If you haven't looked at that part of the document, I think it will be helpful.
> 
> Best regards,
> Kathleen
> 
> 
> 
> On Wed, Oct 10, 2018 at 8:29 PM Manger, James <James.H.Manger@team.telstra.com <mailto:James.H.Manger@team.telstra.com>> wrote:
> https://tools.ietf.org/html/draft-rundgren-json-canonicalization-scheme <https://tools.ietf.org/html/draft-rundgren-json-canonicalization-scheme>
> is a decent attempt at JSON canonicalization (and an appendix lists a few other attempts).
> 
> This one sorts object members based on their UTF-16 encoding (without escapes), and assumes double precision floats is the model for numbers.
> 
>  
> 
> --
> 
> James Manger
> 
>  
> 
> From: jose [mailto:jose-bounces@ietf.org <mailto:jose-bounces@ietf.org>] On Behalf Of Bret Jordan
> Sent: Thursday, 11 October 2018 11:02 AM
> To: Jim Schaad <ietf@augustcellars.com <mailto:ietf@augustcellars.com>>
> Cc: Nathaniel McCallum <npmccallum@redhat.com <mailto:npmccallum@redhat.com>>; jose@ietf.org <mailto:jose@ietf.org>
> Subject: Re: [jose] Canonical JSON form
> 
>  
> 
> 
> Other implementations say that you should preserver the order of the fields you read when serialized which is part of JSON for the browser implementations but not necessarily elsewhere.
> 
>  
> 
> Preserving order is hard.  Depending on your programming language you might be deserializing the content in to a struct or you may be using a map. 
> 
>  
> 
> What I need is a way for individuals and organizations to be able to pass around and share JSON data and collaboratively work on that JSON data and sign the parts that they have done. 
> 
>  
> 
>  
> 
>  
> 
> Thanks,
> 
> Bret
> 
> PGP Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 0050
> 
> "Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg."
> 
>  
> 
>  
> 
> _______________________________________________
> jose mailing list
> jose@ietf.org <mailto:jose@ietf.org>
> https://www.ietf.org/mailman/listinfo/jose <https://www.ietf.org/mailman/listinfo/jose>
> 
> 
> -- 
> 
> Best regards,
> Kathleen