Re: [jose] JWK-specific key fingerprints?

Citation for Canonical JSON:
<http://wiki.laptop.org/go/Canonical_JSON>

I have implemented this in python.  It is surprisingly easy [1].
 Canonicalization has been anathema to this group, but I suspect largely
because people have been bitten by XML canonicalization, rather than
because JSON canonicalization has been tried and found difficult.

If we're going to go down this path, I would prefer Canonical JSON to
bencode, if only because bencode is an entirely different format to
implement.

Personally, given how easy canonicalization is to implement (it actually
requires fewer lines in my experience than base64!), it seems like a
sensible choice in general.  In particular, for the JSON serialization, it
would save some unnecessary base64 encoding that is currently required.  I
would be glad to contr

--Richard

[1] My own canonicalization, not sure if it matches the one linked above <
http://pastebin.com/ptUfn0c3>

On Tue, Feb 12, 2013 at 3:01 PM, Daniel Holth <dholth@gmail.com> wrote:

> On Tue, Feb 12, 2013 at 2:53 PM, Martin Thomson <martin.thomson@gmail.com>wrote:
>
>> On 12 February 2013 10:56, Daniel Holth <dholth@gmail.com> wrote:
>> > ... canonical json ....
>>
>> Isn't mention of canonical JSON a swear-jar offense?  Something needs
>> canonicalization, but JSON seems a poor candidate.
>>
>
> There is something called Canonical JSON. They take out all the
> whitespace, sort keys lexicographically, and only quote the " inside
> strings. It is used in the wild by the OLPC project I think.
>
> bencode is an easier to implement protocol that is used in bittorrent and
> yields a tiny write-only implementation if all you want to do is get unique
> hashes for the subset of JSON used by JWK.
>
> _______________________________________________
> jose mailing list
> jose@ietf.org
> https://www.ietf.org/mailman/listinfo/jose
>
>