Re: [jose] Beyond RFC 8785 (JSON Canonicalization Scheme)

David Waite <david@alkaline-solutions.com> Sat, 11 July 2020 07:26 UTC

Return-Path: <david@alkaline-solutions.com>
X-Original-To: jose@ietfa.amsl.com
Delivered-To: jose@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 944E73A0B55 for <jose@ietfa.amsl.com>; Sat, 11 Jul 2020 00:26:02 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.097
X-Spam-Level:
X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, UNPARSEABLE_RELAY=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=alkaline-solutions.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3hiv1vaSTnDK for <jose@ietfa.amsl.com>; Sat, 11 Jul 2020 00:26:01 -0700 (PDT)
Received: from mail.alkaline-solutions.com (caesium6.alkaline.solutions [157.230.133.164]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 58A4F3A0B41 for <jose@ietf.org>; Sat, 11 Jul 2020 00:26:01 -0700 (PDT)
Received: from authenticated-user (PRIMARY_HOSTNAME [PUBLIC_IP]) by mail.alkaline-solutions.com (Postfix) with ESMTPA id A4A0D38486F; Sat, 11 Jul 2020 07:25:58 +0000 (UTC)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=alkaline-solutions.com; s=dkim; t=1594452359; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=mcl5dCfdUxh2e2Ct6DRKd7t1Fn5/UTtUcIT58kxO7i8=; b=KXC00Ri1Y6c09vSiDvheAzTCu//MKoX4BdJbje9gMuTLPVg03jJOOkcfQdVDmXYzmRwvok +V+0cZPUcBwyowtqPSYw+BvrpY3TthNbhuCT+GJmvR/2DCuGf50hr280K93NNaEX92sY/d 7dCa/32v4Ljs+DOpzwzxGWFMtMJV2AE=
From: David Waite <david@alkaline-solutions.com>
Message-Id: <CF84E380-9312-4B81-97C0-3FED005E7496@alkaline-solutions.com>
Content-Type: multipart/alternative; boundary="Apple-Mail=_D3B673BB-1DA2-4A9B-BEB0-EB5B0B7655C2"
Mime-Version: 1.0
Date: Sat, 11 Jul 2020 01:25:57 -0600
In-Reply-To: <45fb23ee-5f61-1fe1-4d77-7af50096c287@gmail.com>
Cc: Mike Jones <Michael.Jones@microsoft.com>, "jose@ietf.org" <jose@ietf.org>
To: Anders Rundgren <anders.rundgren.net@gmail.com>
References: <MN2PR00MB06880AA5E91B9DC72AF93D25F5650@MN2PR00MB0688.namprd00.prod.outlook.com> <45fb23ee-5f61-1fe1-4d77-7af50096c287@gmail.com>
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=alkaline-solutions.com; s=dkim; t=1594452360; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=mcl5dCfdUxh2e2Ct6DRKd7t1Fn5/UTtUcIT58kxO7i8=; b=IGRMX/9Vk3l3vrIqeOxsSQKsQQWgRETYBY7o/1e40EdhGNRAQZh0WfwHTeC4s6v00uLQtR CWyJMJblU6Pkpv5GBHd6gYPh1ICaJkgj97tAzhONusGxJiZvyy4TcEtzKbiHdis2pIBD6Y ZoeRnj720bfzPkHLN4Klww2WWNg6h1Q=
ARC-Seal: i=1; s=dkim; d=alkaline-solutions.com; t=1594452360; a=rsa-sha256; cv=none; b=HxKFfbIUWbsp+wDvkhR9nuKi+W5eZd3Z9fk2CD3hPs/xkgNb1I6GSG64Mb+7qvcdhhohS4 uJiKLow4tE01OwQCagBFS7+jeDqamd/n0OsCkf2OmtXauQqdC8OmM7H9Y410QKpPF6OWEr ASjzmbIL/NYd3W87+BzfpR7nzkvonaw=
ARC-Authentication-Results: i=1; mail.alkaline-solutions.com; auth=pass smtp.auth=david@alkaline-solutions.com smtp.mailfrom=david@alkaline-solutions.com
Authentication-Results: mail.alkaline-solutions.com; auth=pass smtp.auth=david@alkaline-solutions.com smtp.mailfrom=david@alkaline-solutions.com
X-Spamd-Bar: /
Archived-At: <https://mailarchive.ietf.org/arch/msg/jose/MemBhbzf8sEO077WTdvY6NcgcLo>
Subject: Re: [jose] Beyond RFC 8785 (JSON Canonicalization Scheme)
X-BeenThere: jose@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Javascript Object Signing and Encryption <jose.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/jose>, <mailto:jose-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/jose/>
List-Post: <mailto:jose@ietf.org>
List-Help: <mailto:jose-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/jose>, <mailto:jose-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 11 Jul 2020 07:26:03 -0000

> On Jul 11, 2020, at 00:50, Anders Rundgren <anders.rundgren.net@gmail.com> wrote:
>> On 2020-07-10 22:21, Mike Jones wrote:
>> There are things I would have commented on in JCS if I'd seen intermediate drafts before it became an RFC.  (For instance, I would have asked for explicit serialization instructions for the one ASCII control character not in the range 0x00-0x1F - 0x7F (DEL).)
> 
> Serialization of JSON tokens follows ECMAScript to 100% so the string serialization algorithm is essentially just a copy.

Neither IETF nor ECMA variants of JSON actually define required escaping for the high control points (0x7F-0x9F). So this is likely fairly consistent, if arguably bad behavior.

In the node REPL (which is the same JSON code as Chrome):

> console.log(JSON.stringify({"a":"\u007f"}))
{"a":""}

Printing the code points, that is an inline DEL character in the JSON stringified output.

-DW