Re: [Json] Kicking Off JSONbis

[Anders Rundgren <[e-mail]>]

On 2015-11-11 22:31, Joe Hildebrand (jhildebr) wrote:
> On 11/10/15, 9:19 AM, "Anders Rundgren" <[e-mail]> wrote:
<snip>
>>
>> My target application has since mid-2013 been a JSONesque counterpart
 > to XML's enveloped signatures but without getting bogged down by complex,
 > stand-alone canonicalizers.  The latest developments seem to verify that
 > the most difficult part of JSON (Numbers), also are properly canonicalized
 > by the majority (but not all) ES6 implementations.  This enables very simple
 > and efficient "in-object" JavaScript and JSON signatures which only rely on
 > standard JavaScript for creating and manipulating objects and the built-in
 > JSON parse/stringify methods for parsing and serialization respectively:
>>
>> https://mailarchive.ietf.org/arch/msg/jose/s5TdEtfOdQ0z3Qmtij2yXemZW-A
>
> Oh!  You're relying on the parsing and serializing code to be parallel,
 > such that the parser maintains order, and the serializer repeats that order on output.
>
> Interesting.  However, that would be a major change to the JSON spec (that would
 > necessitate changes to LOTS of existing code, at a performance or memory penalty).
 > It also took me a good amount of time to track down even in the ECMAscript
 > doc - so I don't think you can expect most folks reading ECMA-404 to figure this
 > out either.  If you really want interoperability, there's nothing stopping you
 > from doing something like I-JSON that says an ordered-json is JSON, except for
 > some other constraints.

The depicted signature runs without hiccups in Chrome, Firefox, Safari, and of course
in the Java reference implementation which generated it. The current alternative
is using JWS which encapsulates (=hides) data in Base64 which is perfectly OK for
some applications but (IMO) slightly less appetizing for things like Web Payments.

The genie is out of the bottle and now it is time to wish something :-)

Anders