Re: JSON-RPC vs. YASMIN. Was: A Critical Analysis of REST APIs for "Transaction Systems"

On Mon, Jan 30, 2017 at 7:49 AM, David Nicol <davidnicol@gmail.com> wrote:

> having just read that linked document, it seems like the missing piece is
> a requirement for normalizing the JSON some how before making the digest
> which will get signed. Strong normalization before digestion is needed to
> have meaningful signatures on JSON data. This can mean concatenating some
> subset of the elements of the message in some particular order --
> essentially rewriting it as Bencoded, just to sign it -- or normalizing the
> JSON in such a way that the consumer of the JSON can renormalize the data
> structure they're going to get in such a way that they can check its
> digest, and then its signature.
>

There's an alternative to canonicalization: content-aware hashing that's
independent of the encoding.

Some examples are:

   - Ben Laurie's objecthash: https://github.com/benlaurie/objecthash
   - Peter Todd's proofmarshal:
   https://github.com/petertodd/python-proofmarshal/blob/master/__init__.py