Re: [Json] Canonicalization

[Francis Galiegue <[e-mail]>]

On Wed, Feb 20, 2013 at 3:36 AM, Nico Williams <[e-mail]> wrote:
[...]
>
> Yes and no.  If the verifier and the signer both have the same
> document then no c14n is needed.  If the verifier must reconstruct the
> signed document -as opposed to receiving it from the signer- then the
> verifier must reconstruct exactly the signed document or the signature
> will not verify.
>

There is one thing I don't get: in any case, what is transmitted over
the network is just a stream of bytes. One end writes that stream, the
other reads it.

In order for the receiving end to interpret that data, should signing
be used, it needs to verify that the _byte stream_, not its
interpretation, is correct. That byte stream MAY be JSON. It may not
be.

The problem is therefore, IIUC, that if the protocol exchange has
determined that this byte stream is JSON, then there should exist a
canonical form. OK, but then what about this:

{
    "x": 0.00000000000000000000000000000000000000000000000000000000000000000000000000002
}

This is valid JSON. However hard you wish to canonicalize it, the fact
is, some languages won't read it correctly -- in fact, most languages
won't.

And c14n won't help here.

-- 
Francis Galiegue, [e-mail]
Try out your JSON Schemas: http://json-schema-validator.herokuapp.com