Subject: [Json] Modelling cryptographic types as C# (or similar) Generic Types

From: Phillip Hallam-Baker <[email-masked]>
Date: Mon, 13 Jun 2016 15:03:42 -0400

I spent some time looking into this. I don't think it is going to be useful
and I don't think it is likely to be fixable.

The problem is how to deal with things like typed signed blobs.

So say you have a message that contains a signed object that is a SAML
assertion like object. You might want to have a scheme that says the
signature of the message is something like:

Request Structure
    Issued DateTime
    Credential JWS<Assertion>

And then have that map onto a set of types:

class Request {
   DateTime Issued;
   JWS<Assertion> Credential;
   }

Looks really nice and clean eh? Well it sucks, here is why.

The problem is that C# generic types (and pretty much everything else like
it in Java, etc.) do not actually provide a substitute for multiple
inheritance and that is what you need to model a system like this.

The problem is that when you start specing out a protocol, you would want
to be able to subclass Assertion. And while you can do that, none of the
type systems I have looked at in widely used environments allows you to
write something like

class DerrivedClass : BaseClass {
    }

Generic<BaseClass> Instance = new Generic<DerrivedClass>;

It seems to be a fairly fundamental restriction on the way that the type
system is implemented and it isn't likely this will change any time soon.