Re: [Json] I-D: draft-rundgren-json-canonicalization-scheme-00

[Anders Rundgren <[e-mail]>]

Ping?

JSON canonicalization is impossible or at least very hard.
JSON canonicalization is stupid, just dress everything in Base64Url (like JOSE), and the problem is solved.
JSON canonicalization is unnecessary, JSON is "as is", now we turn to CBOR and ProtoBuf which were designed with canonicalization in mind.

On 2018-03-16 06:46, Anders Rundgren wrote:
> No, this I-D has not yet been submitted to the IETF but it is available anyway :-)
> 
>     Abstract
> 
>          Cryptographic operations like hashing and signing depend on that the target 
>          data does not change during serialization, transport, or parsing. By applying 
>          the rules defined by JCS (JSON Canonicalization Scheme), data provided in the
>          JSON [RFC8259] format can be exchanged "as is", while still being subject to 
>          secure cryptographic operations. JCS achieves this by combining the strict
>          serialization of JSON data defined in ECMAScript [ES6] with a platform
>          independent sorting scheme.
>
>          The intended audiences of this document are JSON tool vendors, as well as 
>          designers of JSON based cryptographic solutions.
 >
> 
> Current draft:
> https://cyberphone.github.io/doc/security/draft-rundgren-json-canonicalization-scheme.html
> 
> Workspace:
> https://github.com/cyberphone/json-canonicalization
> 
> I would be VERY happy to get some feedback on this!
> If you have any interest in co-authoring, I'm open to suggestions.
> 
> Thanx,
> Anders
> 
> // ES6 based JSON canonicalizer
> 'use strict';
> var canonicalize = function(object) {
> 
>      var buffer = '';
>      serialize(object);
>      return buffer;
> 
>      function serialize(object) {
>          if (object !== null && typeof object === 'object') {
>              if (Array.isArray(object)) {
>                  buffer += '[';
>                  let next = false;
> // Array - Maintain element order
>                  object.forEach((element) => {
>                      if (next) {
>                          buffer += ',';
>                      }
>                      next = true;
> // Recursive call
>                      serialize(element);
>                  });
>                  buffer += ']';
>              } else {
>                  buffer += '{';
>                  let next = false;
> // Object - Sort properties before serializing
> Object.keys(object).sort().forEach((property) => {
>                      if (next) {
>                          buffer += ',';
>                      }
>                      next = true;
> // Properties are just strings - Use ES6
>                      buffer += JSON.stringify(property);
>                      buffer += ':';
> // Recursive call
>                      serialize(object[property]);
>                  });
>                  buffer += '}';
>              }
>          } else {
> // Primitive data type - Use ES6
>              buffer += JSON.stringify(object);
>          }
>      }
> };