Re: [Json] RFC 8785 - JSON Canonicalization Scheme

[John Cowan <[e-mail]>]

We need to catch and reject unpaired surrogates because all the world isn't
Java, JavaScript, and C#.  Languages that deal in UTF-8 literally have no
way to represent unpaired surrogates, and shouldn't have to do something
horribly wrong to handle them.

On Sun, Jul 5, 2020 at 9:11 PM Ulysse Carion <[e-mail]> wrote:

> Hi Anders,
>
> Nice job with JCS. I've taken a stab at implementing it here (in
> Golang), because I have a possible use for something like this, and
> your Golang reference implementation wasn't super usable as-is:
>
> https://github.com/ucarion/jcs
>
> Overall, I think this document makes sense, and -- given its
> prerequisites -- is the design any one of us would have landed on
> given time to meditate on the details. I usually specifically avoid
> embedding signatures within the data being signed, but when that's not
> an option JCS seems a quite reasonable choice.
>
> Two notes on what you could do to help future implementers:
>
> 1. I wish you could provide some sort of script that generates
> floating-point test-cases, instead of having folks download a 3.8G
> file if they want to make sure they're correctly aping JavaScript's
> float-to-string algorithm.
>
> 2. I don't understand why implementations MUST detect and error on
> invalid surrogate pairs. For implementations that aren't implementing
> their own JSON parser at the same time, doing so may not always be
> possible. Can you elaborate on the reasoning, and maybe offer
> implementers guidance on the relevant parts of the Unicode spec? A
> prospective implementer already needs to go pretty deep into the hairy
> details of floating-point numbers and character encoding, and a bit of
> guidance in the developer portal would go a long way.
>
> These are just details. Overall, I think JCS is quite nicely done.
> Thanks for making this.
>
> Best,
> Ulysse
>
>
> On Sat, Jul 4, 2020 at 11:27 AM Anders Rundgren
> <[e-mail]> wrote:
> >
> > https://www.rfc-editor.org/rfc/rfc8785
> >
> > In case you would like to test what you can do with JSON
> canonicalization, there are two public Web applications at your disposal:
> > Using JWS: https://mobilepki.org/jws-jcs
> > Using an "unwrapped" JWS called Java Signature Format (JSF):
> https://mobilepki.org/jsf-lab
> >
> > A real-world implementation from OWASP using JSF:
> https://cyclonedx.org/use-cases/#authenticity
> >
> > In Saturn JSF is not only a security solution, it is also used for
> counter-signatures to simplify state-holding in payment systems:
> > https://cyberphone.github.io/doc/saturn/hybrid-payment.html#6
> >
> > By securely embedding related messages in each other (aka "Russian
> doll"), there is no need for external references to previous messages.
> >
> > Enjoy!
> >
> > Anders
> >
> > _______________________________________________
> > json mailing list
> > [e-mail]
> > https://www.ietf.org/mailman/listinfo/json
>
> _______________________________________________
> json mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/json
>