3 ms·
It's interesting that using JSON encoding for all messages eliminates many of the problems. ambiguous encoding? Nothing ambiguous about JSON, you don't even ne
by theamk 2y ago
It's interesting that using JSON encoding for all messages eliminates many of the problems.
ambiguous encoding? Nothing ambiguous about JSON, you don't even need any separator. Or merge them into json array.
length-extension attacks? appending non-whitespace to json makes it invalid (for sane decoders at least)
- skybrian 2y agoYes, but there are lots of ways to get different encodings (and therefore hashes) for the same data: whitespace, JSON object key order, and the different ways of escaping characters. If you want a unique hash (like, for a hash table lookup) then you'll need to sort the keys of every object and use a particular implementation of JSON.stringify. (Also, what do you mean by "you don't even need any separator?")
- magicalhippo 2y agoXML has a complex solution for this, canonicalization[1], to enable signed XMLs[2]. Seems some folks are trying the same with JSON[3]. [1]: https://en.wikipedia.org/wiki/Canonical_XML https://en.wikipedia.org/wiki/Canonical_XML [2]: https://en.wikipedia.org/wiki/XML_Signature https://en.wikipedia.org/wiki/XML_Signature [3]: https://www.rfc-editor.org/rfc/rfc8785 https://www.rfc-editor.org/rfc/rfc8785
- justincormack 2y agoThere are a few canonical json specs but they are different and in my experience the implementations are not correct.