User avatar
neocat_polyproto polyproto federation protocol @polyproto@amazonawaws.com
2w
PURR-2026-0009 "Enforce JSON canonicalization" has exited the draft phase and will likely be merged tomorrow, if no valid objections arise. blobcat

Quoting from the PURR:
polyproto uses JavaScript Object Notation (JSON) as the default format for interchange of data wherever feasible. This is because JSON is the most widely adopted data interchange format in a web-application context, facilitating the protocols ease of adoption.

Digital signatures over JSON data are only verifiable if signer and verifier compute the signature over byte-identical input. Because JSON permits multiple valid serializations of the same logical data (differing key order, whitespace, or number formatting), signing "JSON" without exactly defining its byte representation makes signatures non-reproducible and, in some implementations, exploitable via canonicalization mismatches.
0
4
6
0