Re: Note on JSON signing

On 2016-03-14 21:27, Melvin Carvalho wrote:
>
<snip>
>
> Normalization is really easy, its in the json ld npm library:
>
> // normalize a document using the RDF Dataset Normalization Algorithm
> // (URDNA2015), see: http://json-ld.github.io/normalization/spec/
> jsonld.normalize(doc,{
>    algorithm:'URDNA2015',
>    format:'application/nquads'
> },function(err, normalized){
> // normalized is a string that is a canonical representation of the document
> // that can be used for hashing, comparison, etc.
> });
>
> https://www.npmjs.com/package/jsonld

If you do all the steps yourself you have effectively built your own JSON tools (at least the serializer).

If not, you will most likely be affected by the same quirks as any other system that does not simply
wrap the whole text "as is" like the JOSE folks did.

The Go serializer for example escapes '<','>', '&' which is fine JSON-wise but fails in a signature
scheme that doesn't follow the JOSE method.  However, there are of course workarounds like running
an "unescaper" pass after serialization.  Not exactly rocket science but slightly ugly.
https://github.com/golang/go/issues/14749

Anders

Received on Tuesday, 15 March 2016 04:21:17 UTC