Subject: [dispatch] JSON Canonicalization Standard

From: Anders Rundgren <[email-masked]>
Date: Sat, 11 Aug 2018 07:47:13 +0200

Hi Dispatchers,

I'm currently trying to develop a JSON Canonicalization Standard as an individual effort: https://tools.ietf.org/html/draft-rundgren-json-canonicalization-scheme-01
I have been asked by the individual submission editor to get feedback from the SEC and ART directors but they in turn have directed me to the DISPATCH forum, and here I am :-)

There are efforts creating an alternative to JOSE JWS since there are JSON-based protocols not benefiting from being cast into a form converting signed JSON messages into something completely alien to their unsigned counterpart.  However, after a number of iterations and vendor feedback, I have come to the conclusion that the "Missing Link" is not necessary a new signature format but a way to canonicalize [*] JSON data.

The scheme is currently implemented in Java, C#/.NET, Python3 and EcmaScript V6 (https://www.npmjs.com/package/canonicalize).

Related: https://github.com/cyberphone/jws-jcs#combining-detached-jws-with-jcs-json-canonicalization-scheme
If you want to test the jws-jcs signature scheme, an on-line demo is currently available at: https://mobilepki.org/jws-jcs/home

What do you think?

Sincerely,
Anders Rundgren

*] The goal is rather creating a "hashable" JSON representation but since the described scheme does not change data, these terms are effectively interchangeable.