5 ms·
SSB signs objects like so: { "previous": "%XphMUkWQtomKjXQvFGfsGYpt69sgEY7Y4Vou9cEuJho=.sha256", "author": "@FCX/tsDLpubCPKKfIrw4gc+SQkHcaD17s7
by Vendan 7y ago
SSB signs objects like so:
{
"previous": "%XphMUkWQtomKjXQvFGfsGYpt69sgEY7Y4Vou9cEuJho=.sha256",
"author": "@FCX/tsDLpubCPKKfIrw4gc+SQkHcaD17s7GI6i/ziWY=.ed25519",
"sequence": 2,
"timestamp": 1514517078157,
"hash": "sha256",
"content": {
"type": "post",
"text": "Second post!"
}
}
gets signed like
{
"previous": "%XphMUkWQtomKjXQvFGfsGYpt69sgEY7Y4Vou9cEuJho=.sha256",
"author": "@FCX/tsDLpubCPKKfIrw4gc+SQkHcaD17s7GI6i/ziWY=.ed25519",
"sequence": 2,
"timestamp": 1514517078157,
"hash": "sha256",
"content": {
"type": "post",
"text": "Second post!"
},
"signature": "z7W1ERg9UYZjNfE72ZwEuJF79khG+eOHWFp6iF+KLuSrw8Lqa6
IousK4cCn9T5qFa8E14GVek4cAMmMbjqDnAg==.sig.ed25519"
}
which means that you have to be careful about how you remove the signature in order to verify the original. The "main" node implementation does this by parsing the json, removing the field, and then re serializing, forcing any alternate implementation to exactly match the node serialization in order to be compatible
- wyldfire 7y agoGee, I would just naively wonder whether the scope of the signature includes the outermost closing brace. Does it?
- Vendan 7y agoAt least when I implemented it, it was the full message, as a complete valid json object. The signature would get added as another field, and then the object reserialized.
- tracker1 7y agoThis is why JWT is better... JWT signs "header.body" with each part as base64 from the JSON, and joined with a period. The content in the body and header are immaterial.
- lvh 7y agoIt's not "better", it solves a materially different problem. The article already acknowledges that if you can afford to, you should just stick a tag on the outside. (That's what JWT does, but the actual thing recommended, just HMAC, is better still, for reasons mentioned elsewhere in the comments.)
- juliusmusseau 7y agoThe one approach you missed on that blog post: put an envelope inside an envelope. Does anyone ever do this? { "original":"json", "goes":"here" } Signed: { "original_json_contents_base64":"ewogICJvcmlnaW5hbCI6Impzb24iLAogICJnb2VzIjoiaGVyZSIKfQo=", "hmac_sha256_of_base64":"bf1f4cb95ce8633aff46888e1717873e32bb2a770b3d4b5b74a59e5e9adefeda" } This way you have full control over the raw bytes you want to sign (by forcing them into Base64 where other systems can't get their dirty paws on them). I guess the problem here is if intermediate systems want to do stuff based on the payload (but without validating it), they won't like this. But if the problem is just intermediate systems barfing on non-json, this might work! p.s. enjoyable blog post - as they always are! ;-)
- lvh 7y agoYep! That works, but it's essentially the first option ("How to sign a JSON object") but with JSON as the outer serialization format instead of a comma in the middle. You also correctly identified why that is different from the other schemes: they don't change the structure of the outer object.
- Skunkleton 7y agoYou could also serialize the json with a placeholder string (All spaces or zeroes or something), calculate the HMAC, and substitute the string. You could then do that in reverse on the receiving end. The deserialization could easily note the offset of the hmac, which could then easily be verified against the original bytes.
- lvh 7y agoHow is that distinct from the bait and switch trick in the post?
- ThrustVectoring 7y agoI'd be really curious as to why they chose not to go with something like { "data": {...} "signature": "z7W1ER..." }
- Vendan 7y agoas far as I can tell, it's cause they are hardcore JS devs, where JSON is seen as almost a part of the language, and little to no effort was put into things like future-proofing. A lot of the failings have been fixed as the community grows, but this one is core to how the whole thing works, so changing it at this point is fairly non-trivial (would basically involve completely breaking any kind of backwards compat, and potentially even some forwards compat)
- sytringy05 7y agoprobably they did that, then Roy Fielding came in, unplugged their router and wouldn't let them back on the internet til they stopped polluting their resources with metadata
- gritzko 7y agohttp://seriot.ch/parsing_json.php http://seriot.ch/parsing_json.php Yep, JSON has no round-trip guarantees