Subject: [dispatch] JSON Canonicalization - IETF-104 Meeting Summary

From: Anders Rundgren <[email-masked]>
Date: Fri, 10 May 2019 07:40:30 +0200

Hi Guys,

I have tried to the best of my ability to collect and comment on the issues raised during the 3 meetings held at IETF-104:
https://cyberphone.github.io/ietf-json-canon/ietf-104-report.html

I have just been made aware of that IETF's maybe most ambitious effort creating signed HTTP requests[1] was shot down, making another, less known scheme[2] to some people's dismay turning into a de-facto standard for (at least) Open Banking.  Why was it shot down?  Because it wouldn't work reliable in inferior server configurations which IMO sounds like a pretty unreasonable requirement.

Yes, JCS also won't work satisfactory in every possible scenario but it is clearly stated what the lower bar is:
- JSON Numbers MUST conceptually be treated as IEEE-754 double precision data during parsing/serialization
- JSON Strings MUST (modulo escaping) be treated as immutable during parsing/serialization
The rest is close to trivial.

Thanx,
Anders

1] https://datatracker.ietf.org/doc/draft-ietf-oauth-signed-http-request/
2] https://datatracker.ietf.org/doc/draft-cavage-http-signatures/