Re: [Json] Canonicalization

Canonicalization (c14n) may be a dirty word, and barred from the charter, but I hope it isn't too inappropriate to still discuss it on this email list.

There is a better c14n format for numbers than I or draft-staykov-hu-json-canonical-form have suggested: it is the format produced by JSON.stringify, as defined in ECMAScript v5.1 [http://www.ecma-international.org/ecma-262/5.1/#sec-15.12.3]. Examples: 0, 1, -1000, 0.00002334, 1500000, 6.022e+23, 9.1e-28.

In fact, c14n for JSON can (and should) be simply defined as per JSON.stringify, with two extra constraints: object name/value pairs are sorted; and \uxxxx escapes use lowercase hex digits (a-f). Done. Developers even have a readily available reference implementations simply by typing JSON.stringify(...) into the JavaScript console of their browser.

--
James Manger

> -----Original Message-----
> From: json-bounces@ietf.org [mailto:json-bounces@ietf.org] On Behalf Of
> Manger, James H
> Sent: Wednesday, 20 February 2013 11:58 AM
> To: json@ietf.org
> Subject: Re: [Json] Canonicalization
> 
> We should avoid the need to canonicalize JSON whenever possible, but
> there are enough efforts to define a canonical form that it would be
> worth standardizing one.
> 
> Strings:
> Escaping is mandatory for controls chars, double quote, and backslash
> (%x00-1F / %x22 / %x5C).
> The simplest string canonicalization rule would be to escape those 34
> chars and no others. A rule that might be slightly nicer for people
> (and hence worth the few extra lines of code) would be to always use
> the 7 \x escapes for those 7 chars, always use \uxxxx for the rest of
> %x00-1F, and never use it for any other chars. I would be tempted to
> drop \/ from the list of seven (only in the canonicalization rules),
> because / is so common in URIs etc.
> 
> Objects:
> Sorting string names to canonicalize an object needs a few more words.
> Presumably sorting occurs on the logical strings, not the (canonically)
> encoded versions. So {"a\"b":1,"a#b":2} is in canonical form ("(U+22) <
> #(U+23) < \(U+5C)).
> Presumably sorting uses Unicode code points, not UTF-16 words, or UTF-8
> bytes. So {"\uFFE0\uFFE1":3,"\uD834\uDD1E":4} is in the right order
> (0xFFE0 < 0x01D11E), thought the canonical form would use UTF-8 not
> \uxxxx for the 3 characters.
> [The 21-byte canonical form would be (in hex):
> 7B 22 EFBFA0 EFBFA1 22 3A 33 2C 22 F09D849E 22 3A 34 7D]
> 
> Numbers:
> 0, 1, 1e3, 2.334e-5, 1.5e6 are the sort of canonical form numbers
> should have. I don’t like 0.0E0 for zero as per draft-staykov-hu-json-
> canonical-form-00 -- a person would never write that. That draft also
> allows any number of trailing 0’s (eg 1.200000e-2), which is a bug. A
> canonical form should drop the exponent when it is zero, and drop the
> decimal point when there is nothing after it.
> A regex for numbers in canonical form:
> 
> 0|-?[1-9](\.[0-9]*[1-9])?(e-?[1-9][0-9]*)?
> 
> 
> So draft-staykov-hu-json-canonical-form needs a few changes in my mind,
> but is as good a starting point as any.
> 
> --
> James Manger
> _______________________________________________
> json mailing list
> json@ietf.org
> https://www.ietf.org/mailman/listinfo/json