Re: [jose] Canonical JSON form

Hi

If the signature can be verified then what difference does it make what the
signature value is, the same for every JSON variation or not ? If JSON1,
JSON2, etc, with some minor formatting differences, all make it, after
being validated, into SomeJsonBean, then it should work ?

Thanks, Sergey

On Thu, Oct 11, 2018 at 3:35 PM Bret Jordan <jordan.ietf@gmail.com> wrote:

> Neil,
>
> That is interesting.  But as others have said, I need to be able to round
> trip the content.  The JSON data needs to be consumed by solutions, acted
> on, added to, and resigned.
>
> Thanks,
> Bret
> PGP Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 0050
> "Without cryptography vihv vivc ce xhrnrw, however, the only thing that
> can not be unscrambled is an egg."
>
> On Oct 10, 2018, at 11:33 PM, Neil Madden <neil.madden@forgerock.com>
> wrote:
>
>
> On 11 Oct 2018, at 01:02, Bret Jordan <jordan.ietf@gmail.com> wrote:
>
>
> Other implementations say that you should preserver the order of the
> fields you read when serialized which is part of JSON for the browser
> implementations but not necessarily elsewhere.
>
>
> Preserving order is hard.  Depending on your programming language you
> might be deserializing the content in to a struct or you may be using a
> map.
>
> What I need is a way for individuals and organizations to be able to pass
> around and share JSON data and collaboratively work on that JSON data and
> sign the parts that they have done.
>
>
> Have you considered Git with PGP-signed commits? It solves this use-case
> extremely well.
>
> — Neil
>
>
> _______________________________________________
> jose mailing list
> jose@ietf.org
> https://www.ietf.org/mailman/listinfo/jose
>