W3C home > Mailing lists > Public > public-interledger@w3.org > February 2017

Re: JSON-RPC vs. YASMIN. Was: A Critical Analysis of REST APIs for "Transaction Systems"

From: Anders Rundgren <anders.rundgren.net@gmail.com>
Date: Wed, 8 Feb 2017 09:31:27 +0100
To: Adrian Hope-Bailie <adrian@hopebailie.com>
Cc: Stefan Thomas <stefan@ripple.com>, Interledger Community Group <public-interledger@w3.org>
Message-ID: <f577c41a-eed9-2297-13aa-003534252533@gmail.com>
On 2017-02-08 07:59, Adrian Hope-Bailie wrote:
> If you're signing a something that has a well-known structure beforehand it would seem that a generic canonicalization algorithm is unnecessary overhead.

Of course, but in the case of JSON it has implications on the use-cases you want to address.

Interledger is probably less demanding in that respect than Saturn which also exploits the fact that JSON == JavaScript (withing reason):
https://github.com/cyberphone/saturn/blob/master/desktop-client/test/test.html#L24

The ability to sign JavaScript objects without any special arrangements was actually (but inadvertently) created by one of the JOSE WG members (James Manger). I wasn't even aware of the mere existence of ES6 when I started :-)

Anders

>
> JSON is great for flexible data structures but for use cases like IPR[1] and KEP[2] I like the proposal to simply follow the HTTP approach as proposed in Stefan's comment [3].
>
> [1] https://github.com/interledger/rfcs/blob/master/0011-interledger-payment-request/0011-interledger-payment-request.md <https://github.com/interledger/rfcs/blob/master/0011-interledger-payment-request/0011-interledger-payment-request.md>
>
> [2] https://gist.github.com/sharafian/df7a4b7e2ff000248800b113f06f549a <https://gist.github.com/sharafian/df7a4b7e2ff000248800b113f06f549a>
>
> [3] https://gist.github.com/sharafian/df7a4b7e2ff000248800b113f06f549a#gistcomment-1987340
>
>
> On 8 February 2017 at 07:25, Anders Rundgren <anders.rundgren.net@gmail.com <mailto:anders.rundgren.net@gmail.com>> wrote:
>
>     On 2017-02-08 06:17, Ryan Fugger wrote:
>
>         How important is canonicalization in this case?  Why not just keep the original
>
>     > raw message bytes around for whenever you need to verify the signature?
>
>     That's what the IETF standard prescribes.  It obviously works.
>
>     Not everybody accept the downsides of this approach:
>     https://cyberphone.github.io/doc/security/jsonsignatures.html <https://cyberphone.github.io/doc/security/jsonsignatures.html>
>
>     Anders
>
>
>
>         On Tue, Feb 7, 2017 at 7:19 PM, Stefan Thomas <stefan@ripple.com <mailto:stefan@ripple.com> <mailto:stefan@ripple.com <mailto:stefan@ripple.com>>> wrote:
>
>             Great point, Tony! I think objecthash is a really good candidate for us to adopt for the payment request hashing used in IPR[1] and KEP[2].
>
>             [1] https://github.com/interledger/rfcs/blob/master/0011-interledger-payment-request/0011-interledger-payment-request.md <https://github.com/interledger/rfcs/blob/master/0011-interledger-payment-request/0011-interledger-payment-request.md> <https://github.com/interledger/rfcs/blob/master/0011-interledger-payment-request/0011-interledger-payment-request.md <https://github.com/interledger/rfcs/blob/master/0011-interledger-payment-request/0011-interledger-payment-request.md>>
>
>             [2] https://gist.github.com/sharafian/df7a4b7e2ff000248800b113f06f549a <https://gist.github.com/sharafian/df7a4b7e2ff000248800b113f06f549a> <https://gist.github.com/sharafian/df7a4b7e2ff000248800b113f06f549a <https://gist.github.com/sharafian/df7a4b7e2ff000248800b113f06f549a>>
>
>             On Tue, Feb 7, 2017 at 6:31 PM Tony Arcieri <tony@chain.com <mailto:tony@chain.com> <mailto:tony@chain.com <mailto:tony@chain.com>>> wrote:
>
>                 On Mon, Jan 30, 2017 at 7:49 AM, David Nicol <davidnicol@gmail.com <mailto:davidnicol@gmail.com> <mailto:davidnicol@gmail.com <mailto:davidnicol@gmail.com>>> wrote:
>
>                     having just read that linked document, it seems like the missing piece is a requirement for normalizing the JSON some how before making the digest which will get signed. Strong normalization before digestion is needed to have meaningful signatures on JSON data. This can mean concatenating some subset of the elements of the message in some particular order -- essentially rewriting it as Bencoded, just to sign it -- or normalizing the JSON in such a way that the consumer of the JSON can renormalize the data structure they're going to get in such a way that they can check its digest, and then its signature.
>
>
>                 There's an alternative to canonicalization: content-aware hashing that's independent of the encoding.
>
>                 Some examples are:
>
>                   * Ben Laurie's objecthash: https://github.com/benlaurie/objecthash <https://github.com/benlaurie/objecthash> <https://github.com/benlaurie/objecthash <https://github.com/benlaurie/objecthash>>
>                   * Peter Todd's proofmarshal: https://github.com/petertodd/python-proofmarshal/blob/master/__init__.py <https://github.com/petertodd/python-proofmarshal/blob/master/__init__.py> <https://github.com/petertodd/python-proofmarshal/blob/master/__init__.py <https://github.com/petertodd/python-proofmarshal/blob/master/__init__.py>>
>
>
>
>
>
Received on Wednesday, 8 February 2017 08:32:18 UTC

This archive was generated by hypermail 2.3.1 : Wednesday, 8 February 2017 08:32:18 UTC