Re: [Json] JSON Concluded? Well, maybe not

+1

As a practical matter, the group would need to recharter and what is
proposed is a completely different application and one that many folk,
myself included are skeptical of having been burned on it with XML
Signature.

While it is possible that XML Signature canonicalization is covfefe because
of the convoluted XML semantics, ASN.1 has reasonably precise semantics but
I have yet to find an actual use case for DER. Seriously, VeriSign signed
every certificate using BER for years until someone noticed.

The idea that you can take a signed object, parse it and then re-emit it
from the parsed object is not inherently flawed but I have yet to hear a
good reason to do this. It is one of those terrible ideas that people keep
insisting is 'essential' and cannot give a non referential reason for doing.

We did not do canonicalization in JOSE and not for lack of people
suggesting it.

On Sun, Dec 31, 2017 at 1:50 PM, Tim Bray <tbray@textuality.com> wrote:

> If I were going to make an argument for keeping the WG alive, it would
> require someone to get energized and submit an I-D for a plausible JSON
> schema system, or maybe even a much-needed formalization of JSONPath. We
> use JSONPath a lot at AWS.
>
> On Sun, Dec 31, 2017 at 10:43 AM, Richard Gibson <richard.gibson@gmail.com
> > wrote:
>
>> On the topic of JSON normalization, I believe that canonicaljson-spec
>> <http://gibson042.github.io/canonicaljson-spec/> covers all cases while
>> respecting prior art like https://tools.ietf.org/html/dr
>> aft-staykov-hu-json-canonical-form-00 and RFC 7638. I'd like to get it
>> published as an RFC to handle scenarios like those mentioned by Anders
>> Rundgren, but am not sure how to go about doing so. Is this a good place to
>> ask for assistance?
>>
>> On Sun, Dec 31, 2017 at 12:24 AM, Anders Rundgren <
>> anders.rundgren.net@gmail.com> wrote:
>>
>>> Congratulations everybody to the revised JSON RFC!
>>>
>>> Does this mean that JSON is "done" for good?
>>>
>>> Probably not because the concept I have mentioned from time to time, the
>>> ability adding a digital signature to a JSON object (in contrast to signing
>>> arbitrary Base64Url-encoded data), is still very much alive.  In fact,
>>> there is an I-D in preparation aiming at reducing the current proliferation
>>> of "DIY-standards" for dealing with this highly requested feature.  The
>>> only real challenge is agreeing on a suitable way "normalizing" JSON data
>>> during parsing and serialization.  Such a scheme will be like an extended
>>> version of I-JSON (RFC7493), potentially having an impact on "ordinary"
>>> uses of JSON as well.
>>>
>>> Happy New [and optionally signed] JSON Year
>>> Anders Rundgren
>>>
>>> _______________________________________________
>>> json mailing list
>>> json@ietf.org
>>> https://www.ietf.org/mailman/listinfo/json
>>>
>>
>>
>> _______________________________________________
>> json mailing list
>> json@ietf.org
>> https://www.ietf.org/mailman/listinfo/json
>>
>>
>
>
> --
> - Tim Bray (If you’d like to send me a private message, see
> https://keybase.io/timbray)
>
> _______________________________________________
> json mailing list
> json@ietf.org
> https://www.ietf.org/mailman/listinfo/json
>
>