Re: [secdir] secdir review of draft-ietf-json-text-sequence-11

[Carl Wallace <[e-mail]>]

The new text in the security considerations creates a misimpression that
signature problems require “repeated parsing and re-encoding”.  I suggest
the following mods to the current text to remove this misimpression:

Current:
Repeated parsing and re-encoding of a JSON text sequence can result in the
addition (or stripping) of trailing LF bytes from (to) individual sequence
element JSON texts.  This can break signature validation.  JSON has no
canonical form for JSON texts, therefore neither does the JSON text
sequence format.


Suggested:
Encoding a JSON text sequence will result in the addition of a trailing LF
byte to individual sequence element JSON texts.  This can break signature
validation.  JSON has no canonical form for JSON texts, therefore neither
does the JSON text sequence format.




On 12/19/14, 7:03 AM, "Carl Wallace" <[e-mail]> wrote:

>On 12/18/14, 7:43 PM, "Nico Williams" <[e-mail]> wrote:
>
>><large snip>
>>
>>Integrity mechanisms are out of scope in this document.
>
>OK
>
>><large snip>
>>The upcoming -12 notes the ambiguities and lack of integrity mechanism
>>support.  I propose no further changes regarding how and whether to
>>detect if a trailing LF was added by a sequence encoder or not, or
>>whether to pass it to the JSON text parser.
>
>OK