Mercurial > hg > ietf

annotate jwt_review.txt @ 13:38c8261aebfc

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
renamed, more ascii art
author Henry S. Thompson <ht@inf.ed.ac.uk>
date Thu, 01 May 2025 16:50:41 +0100
parents twt_review.txt@9cb53ac26388
children f2a7c10fbdd7
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
11
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
1 *Summary*
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
2
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
3 *Minor points*
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
4 [this actually borders on the 'substantive', see the discussion under
13
38c8261aebfc renamed,
Henry S. Thompson <ht@inf.ed.ac.uk>
parents: 12
diff changeset
5 Appendix B.]
11
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
6
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
7 4.2.1
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
8 This bullet
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
9
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
10 "JSON-encode the array, producing [a] UTF-8 string"
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
11
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
12 looks simple, but ended up confusing me for over an hour.
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
13
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
14 For the rest of things to work, you must mean "Serialize the array
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
15 to the corresponding utf-8-encoded byte sequence", but that's not
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
16 exactly trivial in the JSON-native context you've adopted in this
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
17 document.
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
18
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
19 That is, at first I thought you should just include one extra
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
20 step in the Disclosure construction, example, namely what the
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
21 UTF-8 (byte) string looks like as (what RFC8259 calls) "UTF-8
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
22 encoded JSON text", immediately after the array creation
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
23 display:
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
24
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
25 ["_26bc4LT-ac6q2KI6cBW5es", "family_name", "Möbius"] (1)
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
26
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
27 "[\"_26bc4LT-ac6q2KI6cBW5es\", \"family_name\", \"M\u00c3\u00b6bius\"]" (2)
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
28
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
29 but that's really ugly and would be more likely to confuse than clarify.
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
30
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
31 Note that in only the first 64bitURL Disclosure
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
32 samples that you offer decodes to my guess (2)! And indeed
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
33 what they _do_ decode to, that is
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
34
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
35 '["_26bc4LT-ac6q2KI6cBW5es", "family_name", "Möbius"]' # 4d c3 b6 62 69 75 73
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
36
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
37 '["_26bc4LT-ac6q2KI6cBW5es", "family_name", "M\\u00f6bius"]'
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
38
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
39 respectively, are non-trivially distinct, as in both Python and
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
40 node.js these, as strings, correspond to two _different_
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
41 byte-sequences (the second is 4 bytes longer than the first and,
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
42 if both are decoded as utf-8, to 5 more characters). It's true
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
43 that they are both valid JSON texts, per RFC8259, but you have to
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
44 apply a JSON parser to them to get to indistinguishable JSON objects.
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
45
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
46 Apologies for this lengthy attempt to show where I think you've
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
47 gotten in to trouble by specifying _algorithms_ in informal
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
48 english, while more-or-less assuming, I'm guessing, some library
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
49 functions in whatever language you're used to using.
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
50
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
51 To address this problem, since you use "JSON-encode" a number of
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
52 times in later sections, I would _strongly recommend_ that you
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
53
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
54 a) Add the following to section 1.2, immediately after the
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
55 definition of *base64url*:
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
56
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
57 *JSON-encode* denotes the conversion of a JSON object to
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
58 "JSON text" and encoding that text in UTF-8, as defined in
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
59 RFC 8529. That is, mapping a JSON object to a UTF-8 byte
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
60 sequence which when decoded and parsed will reconstruct an
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
61 object indistinguishable from the original.
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
62
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
63 b) Replace that problematic bullet, and the next, with
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
64
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
65 * JSON-encode the array, producing a UTF-8 encoded byte sequence.
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
66
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
67 * base64url-encode the resulting byte sequence. The resulting
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
68 string is the Disclosure.
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
69
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
70 c) Be careful never to use "string" when "(UTF-8) byte sequence"
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
71 is meant, starting in 4.2.2 with
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
72
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
73 The Disclosure string is created by JSON-encoding this array
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
74 and base64url-encoding the resulting byte sequence as
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
75 described in Section 4.2.1
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
76
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
77 d) In the second media type registration in 12.2
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
78 "represented as a JSON Object" ->
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
79 'represented as UTF-8 encoded "JSON text" as defined in RFC 8529'
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
80
12
9cb53ac26388 mostly done with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents: 11
diff changeset
81 e) Include RFC 8529 in 13.1
11
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
82
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
83 Appendix B.
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
84
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
85 The above problem resurfaces here, with confusion between three
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
86 possible interpretations, in the terms of RFC 8529, of what is
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
87 displayed:
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
88
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
89 * a JSON object, that is, structured data composed of
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
90 instances of the six primitive types which JSON can
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
91 represent. It is _not_ to be understood as string, byte
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
92 sequence or file contents;
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
93
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
94 * a possible JSON text for some JSON object.
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
95
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
96 * a UTF-8 encoding of some JSON text, aka a "JSON encoding".
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
97
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
98 The first figure is labelled as a JSON object, which is OK.
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
99
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
100 But it is indistinguishable from one of the possible
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
101 JSON texts corresponding to that object.
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
102
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
103 The next figure purports to present two alternative "JSON
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
104 encodings", the second of which is problematic.
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
105
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
106 Its first line appears indistinguishable from that shown for the
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
107 JSON object in the preceding figure, but is in fact different.
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
108
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
109 In the first figure, construed as a "JSON text", the o-umlaut
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
110 glyph denotes a single Unicode character in a six-character
12
9cb53ac26388 mostly done with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents: 11
diff changeset
111 representation of a six-character object member string value.
11
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
112
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
113 However in the second figure, second alternative, the o-umlaut
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
114 corresponds to a _two_-byte UTF-8 sub-part of the JSON encoding of
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
115 that value as a seven-byte UTF-8 byte sequence, either in some
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
116 internal representation or an external stream or file.
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
117
12
9cb53ac26388 mostly done with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents: 11
diff changeset
118 What to do? First, add something similar to
9cb53ac26388 mostly done with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents: 11
diff changeset
119 https://www.ietf.org/archive/id/draft-bray-unichars-14.html#name-notation
9cb53ac26388 mostly done with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents: 11
diff changeset
120 Then, whenever presenting JSON, always indicate whether what is
9cb53ac26388 mostly done with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents: 11
diff changeset
121 being shown is JSON text or JSON-encoded text (i.e. UTF-8 encoded
9cb53ac26388 mostly done with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents: 11
diff changeset
122 JSON text). In JSON text, always include a version using the
9cb53ac26388 mostly done with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents: 11
diff changeset
123 U+xxxx notation whenever the underlying string contains non-ASCII
9cb53ac26388 mostly done with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents: 11
diff changeset
124 characters. In JSON-encoded text, _always_ use the %xnn notation
9cb53ac26388 mostly done with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents: 11
diff changeset
125 for non-ASCII characters.
9cb53ac26388 mostly done with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents: 11
diff changeset
126
9cb53ac26388 mostly done with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents: 11
diff changeset
127 Some examples of a possible way of indicating JSON text and
9cb53ac26388 mostly done with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents: 11
diff changeset
128 JSON-encoded text, from section 4.2.1
9cb53ac26388 mostly done with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents: 11
diff changeset
129
9cb53ac26388 mostly done with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents: 11
diff changeset
130 Replace the first figure with these two:
9cb53ac26388 mostly done with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents: 11
diff changeset
131
9cb53ac26388 mostly done with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents: 11
diff changeset
132 _________________________________________________________
9cb53ac26388 mostly done with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents: 11
diff changeset
133 |*JT* |
9cb53ac26388 mostly done with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents: 11
diff changeset
134 | |
9cb53ac26388 mostly done with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents: 11
diff changeset
135 | ["_26bc4LT-ac6q2KI6cBW5es", "family_name", "Möbius"] |
9cb53ac26388 mostly done with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents: 11
diff changeset
136 | ^ |
9cb53ac26388 mostly done with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents: 11
diff changeset
137 | | |
9cb53ac26388 mostly done with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents: 11
diff changeset
138 | X+00F6 |
9cb53ac26388 mostly done with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents: 11
diff changeset
139 | |
9cb53ac26388 mostly done with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents: 11
diff changeset
140 |________________________________________________________|
9cb53ac26388 mostly done with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents: 11
diff changeset
141
9cb53ac26388 mostly done with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents: 11
diff changeset
142 _______________________________________________________________
9cb53ac26388 mostly done with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents: 11
diff changeset
143 |*J-ET* |
9cb53ac26388 mostly done with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents: 11
diff changeset
144 | |
9cb53ac26388 mostly done with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents: 11
diff changeset
145 | ["_26bc4LT-ac6q2KI6cBW5es", "family_name", "M%xc3%xb6bius"] |
9cb53ac26388 mostly done with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents: 11
diff changeset
146 | |
9cb53ac26388 mostly done with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents: 11
diff changeset
147 |_______________________________________________________________|
9cb53ac26388 mostly done with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents: 11
diff changeset
148
9cb53ac26388 mostly done with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents: 11
diff changeset
149 and the first bullet of the three alternatives which follow with
9cb53ac26388 mostly done with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents: 11
diff changeset
150
9cb53ac26388 mostly done with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents: 11
diff changeset
151 * A different way to encode the unicode o-umlaut:
9cb53ac26388 mostly done with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents: 11
diff changeset
152
9cb53ac26388 mostly done with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents: 11
diff changeset
153 ______________________________________________________________
9cb53ac26388 mostly done with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents: 11
diff changeset
154 |*JT* |
9cb53ac26388 mostly done with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents: 11
diff changeset
155 | |
9cb53ac26388 mostly done with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents: 11
diff changeset
156 | ["_26bc4LT-ac6q2KI6cBW5es", "family_name", "M\x00f6bius"] |
9cb53ac26388 mostly done with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents: 11
diff changeset
157 | |
9cb53ac26388 mostly done with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents: 11
diff changeset
158 |_____________________________________________________________|
9cb53ac26388 mostly done with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents: 11
diff changeset
159
9cb53ac26388 mostly done with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents: 11
diff changeset
160 ______________________________________________________________
9cb53ac26388 mostly done with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents: 11
diff changeset
161 |*J-ET* |
9cb53ac26388 mostly done with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents: 11
diff changeset
162 | |
9cb53ac26388 mostly done with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents: 11
diff changeset
163 | ["_26bc4LT-ac6q2KI6cBW5es", "family_name", "M\x00f6bius"] |
9cb53ac26388 mostly done with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents: 11
diff changeset
164 | |
9cb53ac26388 mostly done with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents: 11
diff changeset
165 |_____________________________________________________________|
9cb53ac26388 mostly done with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents: 11
diff changeset
166
9cb53ac26388 mostly done with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents: 11
diff changeset
167 WyJfMjZiYzRMVC1hYzZxMktJNmNCVzVlcyIsICJmYW1pbHlfbmFtZSIsICJNX
9cb53ac26388 mostly done with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents: 11
diff changeset
168 HUwMGY2Yml1cyJd
9cb53ac26388 mostly done with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents: 11
diff changeset
169
13
38c8261aebfc renamed,
Henry S. Thompson <ht@inf.ed.ac.uk>
parents: 12
diff changeset
170 And throughout the examples in Appendices A and B, label the initial
38c8261aebfc renamed,
Henry S. Thompson <ht@inf.ed.ac.uk>
parents: 12
diff changeset
171 figure with *JT* and the 'Content' boxes with *J-ET*. You don't
38c8261aebfc renamed,
Henry S. Thompson <ht@inf.ed.ac.uk>
parents: 12
diff changeset
172 need to gloss every Chinese/German string with their U+xxxx version,
38c8261aebfc renamed,
Henry S. Thompson <ht@inf.ed.ac.uk>
parents: 12
diff changeset
173 but saying something at the top of A that where non-ASCII characters
38c8261aebfc renamed,
Henry S. Thompson <ht@inf.ed.ac.uk>
parents: 12
diff changeset
174 appear in any of the initial examples that the actual Unicode
38c8261aebfc renamed,
Henry S. Thompson <ht@inf.ed.ac.uk>
parents: 12
diff changeset
175 character is what is meant.
38c8261aebfc renamed,
Henry S. Thompson <ht@inf.ed.ac.uk>
parents: 12
diff changeset
176
38c8261aebfc renamed,
Henry S. Thompson <ht@inf.ed.ac.uk>
parents: 12
diff changeset
177 The Appendix B example then looks like this, along with some small
38c8261aebfc renamed,
Henry S. Thompson <ht@inf.ed.ac.uk>
parents: 12
diff changeset
178 changes to the text:
38c8261aebfc renamed,
Henry S. Thompson <ht@inf.ed.ac.uk>
parents: 12
diff changeset
179
38c8261aebfc renamed,
Henry S. Thompson <ht@inf.ed.ac.uk>
parents: 12
diff changeset
180 Usually, JSON-based formats transport claim values as simple
38c8261aebfc renamed,
Henry S. Thompson <ht@inf.ed.ac.uk>
parents: 12
diff changeset
181 properties of a JSON object such as this:
38c8261aebfc renamed,
Henry S. Thompson <ht@inf.ed.ac.uk>
parents: 12
diff changeset
182
38c8261aebfc renamed,
Henry S. Thompson <ht@inf.ed.ac.uk>
parents: 12
diff changeset
183 _________________________________________
38c8261aebfc renamed,
Henry S. Thompson <ht@inf.ed.ac.uk>
parents: 12
diff changeset
184 |*JT* |
38c8261aebfc renamed,
Henry S. Thompson <ht@inf.ed.ac.uk>
parents: 12
diff changeset
185 | |
38c8261aebfc renamed,
Henry S. Thompson <ht@inf.ed.ac.uk>
parents: 12
diff changeset
186 | ... |
38c8261aebfc renamed,
Henry S. Thompson <ht@inf.ed.ac.uk>
parents: 12
diff changeset
187 | "family_name": "Möbius", |
38c8261aebfc renamed,
Henry S. Thompson <ht@inf.ed.ac.uk>
parents: 12
diff changeset
188 | "address": { |
38c8261aebfc renamed,
Henry S. Thompson <ht@inf.ed.ac.uk>
parents: 12
diff changeset
189 | "street_address": "Schulstr. 12", |
38c8261aebfc renamed,
Henry S. Thompson <ht@inf.ed.ac.uk>
parents: 12
diff changeset
190 | "locality": "Schulpforta" |
38c8261aebfc renamed,
Henry S. Thompson <ht@inf.ed.ac.uk>
parents: 12
diff changeset
191 | } |
38c8261aebfc renamed,
Henry S. Thompson <ht@inf.ed.ac.uk>
parents: 12
diff changeset
192 | ... |
38c8261aebfc renamed,
Henry S. Thompson <ht@inf.ed.ac.uk>
parents: 12
diff changeset
193 |________________________________________|
38c8261aebfc renamed,
Henry S. Thompson <ht@inf.ed.ac.uk>
parents: 12
diff changeset
194
38c8261aebfc renamed,
Henry S. Thompson <ht@inf.ed.ac.uk>
parents: 12
diff changeset
195
11
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
196
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
197 *Nits*
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
198
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
199 4. "(for those who celebrate)" will be anywhere from obscure to
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
200 confusing for many readers from many cultures -- best to remove it.
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
201
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
202 4.2.1. "an UTF-8" -> "a UTF-8" [overtaken by 4.2.1 above]
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
203
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
204 "However, the digest is calculated over the respective
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
205 base64url-encoded value itself, which effectively signs"
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
206
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
207 ->
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
208
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
209 "Because the digest is calculated over the respective
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
210 base64url-encoded value itself, this effectively signs"
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
211
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
212 4.3.1. I'd recommend
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
213 "The bytes of the digest MUST" -> "The bytes of the sd_hash value MUST"
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
214
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
215 6. I have decoded a few of the Disclosures and they're fine, but you
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
216 might want to ask a friendly 3rd party to double-check all the
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
217 Disclosures and digests, at least here and in Appendix A.
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
218
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
219 9. "Security considerations in this section help achieve the
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
220 following properties:"
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
221
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
222 This confused me for a while. I think what you mean to say here
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
223 is something like
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
224
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
225 This spec aims to provide two security guarantees:
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
226
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
227 *Selective Disclosure*: ...
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
228
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
229 *Integrity*: ...
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
230
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
231 The following sub-sections show how the various aspects of the
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
232 design presented here combine to achieve this.
bc100f494ca0 nearly done, still struggling with o-umlaut
Henry S. Thompson <ht@inf.ed.ac.uk>
parents:
diff changeset
233