Subject: Re: [dispatch] JSON Canonicalization Scheme (JCS) Proposal

From: Ben Campbell <[email-masked]>
Date: Tue, 7 May 2019 16:32:45 -0500

(as DISPATCH chair)

It would be helpful to hear some more voices here. Does anyone else have opinions? Especially people involved in those side meetings?

Bret, could you offer a very high level summary of the side discussions from Prague?

Thanks!

Ben.

> On Apr 29, 2019, at 1:44 PM, Bret Jordan <[email-masked]> wrote:
> 
> Dispatch,
> 
> During IETF 104 there were several meetings and sessions about the proposed JCS solution. This JCS solution defines a way to canonicalize JSON data to enable hash-able JSON. After listening to and working through most of the concerns that were raised, there seems to be some significant interest and use-cases for moving this work forward.
> 
> We respectfully request that DISPATCH look at this work and determine where it would best fit in the IETF.  We would also like to request that DISPATCH add this to the next interim or full meeting.
> 
> The current draft can be found here: https://tools.ietf.org/html/draft-rundgren-json-canonicalization-scheme-05 <https://tools.ietf.org/html/draft-rundgren-json-canonicalization-scheme-05>
> 
> Further, many successful implementations for several different platforms as well as a public "playground" https://mobilepki.org/jws- <https://mobilepki.org/jws->jcs/home have been created to show that this not only works, but is pretty easy to implement.
> 
> Personally I know many organizations and solutions that desperately need this for production.   Thank you for your consideration.
> 
> 
> Thanks,
> Bret
> PGP Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 0050
> "Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg."
> 
> _______________________________________________
> dispatch mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dispatch

---

From: Eric Rescorla <[email-masked]>
Date: Tue, 7 May 2019 14:36:07 -0700

On Tue, May 7, 2019 at 2:33 PM Ben Campbell <[email-masked]> wrote:

> (as DISPATCH chair)
>
> It would be helpful to hear some more voices here. Does anyone else have
> opinions? Especially people involved in those side meetings?
>

FWIW, none of this has really changed me opinion of this from Prague or
made me more enthusiastic about this work.

-Ekr

> During IETF 104 there were several meetings and sessions about the
> proposed JCS solution. This JCS solution defines a way to canonicalize JSON
> data to enable hash-able JSON. After listening to and working through most
> of the concerns that were raised, there seems to be some significant
> interest and use-cases for moving this work forward.
>
> We respectfully request that DISPATCH look at this work and determine
> where it would best fit in the IETF.  We would also like to request that
> DISPATCH add this to the next interim or full meeting.
>
> The current draft can be found here:
> https://tools.ietf.org/html/draft-rundgren-json-canonicalization-scheme-05
>
> Further, many successful implementations for several different platforms
> as well as a public "playground" https://mobilepki.org/jws-jcs/home have
> been created to show that this not only works, but is pretty easy to
> implement.
>
> Personally I know many organizations and solutions that desperately need
> this for production.   Thank you for your consideration.
>
>
> Thanks,
> Bret

---

From: "Matthew A. Miller" <[email-masked]>
Date: Thu, 9 May 2019 10:40:32 -0600

> opinions? Especially people involved in those side meetings?

As expressed at various sessions at IETF 104, I think this work carries
consequences.  As it progresses, I think use cases need to be discussed
and their consequences considered and documented.

JSON is a simple format, that has and is used for representing complex
things.  JCS is not going to cover all those things by itself.

- m&m

Matthew A. Miller

---

From: Brian Campbell <[email-masked]>
Date: Fri, 10 May 2019 09:43:39 -0600

Similar to Ekr, none of this has really changed my opinion of this work or
made me more enthusiastic about it.
https://mailarchive.ietf.org/arch/msg/dispatch/RCRQgw69-jn0IlwnH1JTA7dwOlE

-- 
_CONFIDENTIALITY NOTICE: This email may contain confidential and privileged 
material for the sole use of the intended recipient(s). Any review, use, 
distribution or disclosure by others is strictly prohibited.  If you have 
received this communication in error, please notify the sender immediately 
by e-mail and delete the message and any file attachments from your 
computer. Thank you._

---

From: Anders Rundgren <[email-masked]>
Date: Sat, 11 May 2019 07:33:15 +0200

On 2019-05-10 17:43, Brian Campbell wrote:
> Similar to Ekr, none of this has really changed my opinion of this work or made me more enthusiastic about it. https://mailarchive.ietf.org/arch/msg/dispatch/RCRQgw69-jn0IlwnH1JTA7dwOlE

Brian & Ekr,

If the lack of enthusiasm is due to a belief that clear text data is a no-issue [*], I have nothing to add since that is merely an opinion.
If OTOH this is rather due to the technology itself a reference to the actual draft would be more than welcome.

https://cyberphone.github.io/ietf-json-canon/ietf-104-report.html
https://tools.ietf.org/html/draft-rundgren-json-canonicalization-scheme-06

JCS is not a fullblown canonicalization scheme like XML's C14; it is a (fairly rudimentary) serialization method.
The bad experiences from the XML era BTW were also due to other factors such as Namespaces, SOAP and an elaborate WS* stack which indeed took years to get fully interoperable between vendors.

thanx,
Anders

*] None of the current Open Banking APIs encode their signed messages in Base64Url

> 
> On Tue, May 7, 2019 at 3:36 PM Eric Rescorla <[email-masked] <mailto:[email-masked]>> wrote:
> 
> 
> 
>     On Tue, May 7, 2019 at 2:33 PM Ben Campbell <[email-masked] <mailto:[email-masked]>> wrote:
> 
>         (as DISPATCH chair)
> 
>     FWIW, none of this has really changed me opinion of this from Prague or made me more enthusiastic about this work.
> 
>     -Ekr
> 
> 
>>         On Apr 29, 2019, at 1:44 PM, Bret Jordan <[email-masked] <mailto:[email-masked]>> wrote:
>>
>>         Dispatch,
>>
>>         The current draft can be found here: https://tools.ietf.org/html/draft-rundgren-json-canonicalization-scheme-05
>>
>>         Further, many successful implementations for several different platforms as well as a public "playground" https://mobilepki.org/jws-jcs/home have been created to show that this not only works, but is pretty easy to implement.
>>
>>         [email-masked] <mailto:[email-masked]>
>         [email-masked] <mailto:[email-masked]>
>     [email-masked] <mailto:[email-masked]>
> /CONFIDENTIALITY NOTICE: This email may contain confidential and privileged material for the sole use of the intended recipient(s). Any review, use, distribution or disclosure by others is strictly prohibited..  If you have received this communication in error, please notify the sender immediately by e-mail and delete the message and any file attachments from your computer. Thank you./
>