Re: [Json-canon] [EXT] Re: Support for a WG

Carsten,

I do not see what the hang up is for doing this. There is a document that proposes a very nice solution.  There are libraries for various programming languages that can do this.  What we need is a standard that people can reference when they want to use it.  At the end of the day people, organizations, vendors, and groups need a way of dealing with white space, ordering, and the JSON Number type in a consistent way.  They do not want to use CBOR, ASN.1, XML, or anything else.  The market wants to use plain and simple JSON. Right now we have various groups and organizations going off and doing their own form of this. It will save a lot of pain if we could just, finally, standardize this. 

Lets not make this overly complicated.  Organizations, vendors, other standards, and other working groups want the ability to use JSON “as-is” and perform security operations on that string of data.  To do this, we need a canonical string of data that can be consistently generated.   

Thanks,
Bret
PGP Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 0050
"Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg."

> On Jan 22, 2019, at 7:05 PM, Carsten Bormann <cabo@tzi.org> wrote:
> 
> Hi Richard,
> 
>> On Jan 22, 2019, at 13:31, Struse, Richard J. <rjs@mitre.org> wrote:
>> 
>> The use case is to enable other standards that use a JSON serialization to be able to count on two objects, each with the same contents, having the same hash value based on their representation in JSON.
> 
> Well, that is the technical requirement, but what do you use this property for?
> 
> JSON was discovered/presented around 2002 and so far has worked quite well without this property.  What use cases have sprung up that now need it?
> 
> I’m asking because for many use cases I have heard, there actually are better technical approaches than canonicalization.  Having said that, CBOR, a data format defined in 2013, does have recommendations for deterministic encoding (“canonicalization”), which turned out to be useful for instance for test scripts.  One thing we found out quickly is that deterministic encoding is dependent on the application concept of equality, so it is hard to define a single variant of it for a serialization used in multiple applications.  One more reason to find out about use cases.
> 
> Grüße, Carsten
> 
> -- 
> json-canon mailing list
> json-canon@ietf.org
> https://www.ietf.org/mailman/listinfo/json-canon