[Json] A Crypto-compliant JSON Implementation

Anders Rundgren <anders.rundgren.net@gmail.com> Wed, 07 October 2015 06:16 UTC

To: json@ietf.org
From: Anders Rundgren <anders.rundgren.net@gmail.com>
Message-ID: <5614B8B9.2050405@gmail.com>
Date: Wed, 07 Oct 2015 08:16:25 +0200
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:38.0) Gecko/20100101 Thunderbird/38.3.0
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"; format="flowed"
Content-Transfer-Encoding: 7bit
Archived-At: <http://mailarchive.ietf.org/arch/msg/json/wfyXZ6mzDwQqVMUw-UT_-L1fhQU>
Subject: [Json] A Crypto-compliant JSON Implementation
Precedence: list

A Crypto-compliant JSON Implementation
==================================

Although maybe not a topic for the IETF, I would anyway like (for those who don't follow the JOSE list) to describe a JSON implementation which enables "Signed JSON".

Didn't the JOSE WG just finished that?  No, the JOSE WG have rather created a set of JSON-flavored and URL-friendly cryptographic containers where the actual data has no relation to JSON ; the data is Base64URL-encoded to be neutral to the content.

Anyway, for me working payment systems and similar where signed JSON messages are wrapped by other signed JSON messages like "Russian dolls", Base64 simply wasn't an option:
http://xmlns.webpki.org/webpay/v1/webpay-card-payment-messages.html#p11

How much did I have to "violate" the JSON specification to accomplish this?  Not a single bit.
What I did was simply parsing properties using LinkedHashMap (to maintain a predictive order) plus a minute fix for numbers keeping the original textual representation in the background for serialization.

This also has the benefit that properties are serialized in the same order as they were created which is a feature often requested by the JSON community at large which isn't too surprising since XML elements, EDI, ASN.1, and plain-text always had this quality.

Anders
https://mobilepki.org/jcs

[Json] A Crypto-compliant JSON Implementation Anders Rundgren