Re: [jose] JWK-specific key fingerprints?

[Daniel Holth <[e-mail]>]

On Mon, Feb 18, 2013 at 12:51 PM, Richard Barnes <[e-mail]> wrote:

> Citation for Canonical JSON:
> <http://wiki.laptop.org/go/Canonical_JSON>
>
> I have implemented this in python.  It is surprisingly easy [1].
>  Canonicalization has been anathema to this group, but I suspect largely
> because people have been bitten by XML canonicalization, rather than
> because JSON canonicalization has been tried and found difficult.
>
> If we're going to go down this path, I would prefer Canonical JSON to
> bencode, if only because bencode is an entirely different format to
> implement.
>
> Personally, given how easy canonicalization is to implement (it actually
> requires fewer lines in my experience than base64!), it seems like a
> sensible choice in general.  In particular, for the JSON serialization, it
> would save some unnecessary base64 encoding that is currently required.  I
> would be glad to contr
>
> --Richard
>
> [1] My own canonicalization, not sure if it matches the one linked above <
> http://pastebin.com/ptUfn0c3>
>
>
>
> On Tue, Feb 12, 2013 at 3:01 PM, Daniel Holth <[e-mail]> wrote:
>
>> On Tue, Feb 12, 2013 at 2:53 PM, Martin Thomson <[e-mail]
>> > wrote:
>>
>>> On 12 February 2013 10:56, Daniel Holth <[e-mail]> wrote:
>>> > ... canonical json ....
>>>
>>> Isn't mention of canonical JSON a swear-jar offense?  Something needs
>>> canonicalization, but JSON seems a poor candidate.
>>>
>>
>> There is something called Canonical JSON. They take out all the
>> whitespace, sort keys lexicographically, and only quote the " inside
>> strings. It is used in the wild by the OLPC project I think.
>>
>> bencode is an easier to implement protocol that is used in bittorrent and
>> yields a tiny write-only implementation if all you want to do is get unique
>> hashes for the subset of JSON used by JWK.
>>
>
Especially if you are not worried about the CJSON corner cases (which go
away when your data is all printable ASCII) it is stupidly simple. The rest
of the spec would be to exclude the members of the JWK that are not used by
the crypto math (need a better way to say this) and to give it a name like
"hash kid" -> "hkid".