Subject: [Cbor] Canonical Encoding Issues

From: Jim Schaad <[email-masked]>
Date: Sun, 4 Mar 2018 21:50:39 -0800

I have been spending the last two hours trying to convince myself that what
I am proposing below is wrong.  I have been unable to do so.  If the data
model had not been introduced, then I do not believe that I would have this
issue.  I would be more than happy to be convinced that this position is
wrong, but I don't believe it can be done.

The rules for canonical encoding MUST include all items which are in the
data model.  Those values that are in the extended data model can be
deferred and left to the application as many of those decisions are going to
be very context dependent.  Which of the n different methods should be used
for encoding a date?  Not something that this document either needs or wants
to get into.

Implication #1

The document needs to decide on a single rule for encoding a floating point
value and stick to it.   I do not have a preference between rules 2 and 3,
but I do have a problem with rule 1 - again this is no longer how the data
model works.

Implication #2

All text that deals with how to encode extended data model items, such as a
date or a big number, can now be moved to a section that is dedicated to
that problem.  For the most part this can say that applications need to have
criteria on how to do this if they need canonicalization.  This section is
now applicable both to the "correct" and to the "incorrect" method of doing
base model canonicalization (i.e. 4.9 vs 4.9.1)

Implication #3

A decision needs to be made about who is going to be best to list the set of
issues for each of the extended model types that are in this document which
have canonicalization issues:  This document or set of random people who
decide they need to do that canonicalization.  I have not read the pull
request to see if it covers all of the issues, canonicalization is something
that I don't really believe in any more as my expectation is that people
will mess it up and then all of those errors need to be dealt with.  This
has been the experience that doing X.509 certificates has certainly pounded
into my skull.  One example that I ran into today that is easily visible,
but that I had not looked for, is what is the canonical text representation
of a date when encoded as a string.  The strings that I created and that Joe
created for the interop matrix were not the same.  It took me a while to
figure out that this was the problem and get things checked correctly.  

Jim