Subject: [jose] FW: Issue #81 - String Comparison Rules

From: "Jim Schaad" <[email-masked]>
Date: Mon, 4 Nov 2013 11:44:30 -0800

Not in the archive

From: Jim Schaad [mailto:[email-masked]] 
Sent: Tuesday, October 01, 2013 5:19 PM
To: [email-masked]
Subject: Issue #81 - String Comparison Rules

This is the current text from rfc4627bis.

 <http://tools.ietf.org/html/draft-ietf-json-rfc4627bis-04#section-8.3> 8.3.
String Comparison

   Software implementations are typically required to test names of
   object members for equality.  Implementations which transform the
   textual representation into sequences of Unicode code units, and then
   perform the comparison numerically, code unit by code unit, are
   interoperable in the sense that implementations will agree in all
   cases on equality or inequality of two strings.  For example,
   implementations which compare strings with escaped characters
   unconverted may incorrectly find that "a\b" and "a\u005Cb" are not
   equal.

>From this it would appear that the only thing that we say differently is to
explicitly state that normalization is not to be done before the comparison
is made.  It is implicit in the JSON text rather than explicit.

Given this I would say the following:

1.       It is not clear to me that we need to make any statements beyond

a.       When comparing member names, one needs to follow the rules of
Section 8.3 in JSON [rfc4627bis].

b.      When comparing member values, one uses the same comparison rules as
those for comparing member names.

2.       The recommendations for expert reviewers need to make a statement
that if there are multiple normalizations for a string in the registry, the
same string with a different normalization MUST NOT be permitted.

3.       There may be someplace that we need to make a general statement,
possibly in section 8.3 that says that when using values from the registry,
the registry normalization needs to be used.

If this is not controversial, I can workup text to this effect.

Jim

---

From: Mike Jones <[email-masked]>
Date: Mon, 4 Nov 2013 19:49:12 +0000

Sure - go ahead and propose text.

From: [email-masked] [mailto:[email-masked]] On Behalf Of Jim Schaad
Sent: Monday, November 04, 2013 11:45 AM
To: [email-masked]
Subject: [jose] FW: Issue #81 - String Comparison Rules

Not in the archive

From: Jim Schaad [mailto:[email-masked]]
Sent: Tuesday, October 01, 2013 5:19 PM
To: [email-masked]<mailto:[email-masked]>
Subject: Issue #81 - String Comparison Rules

8.3<http://tools.ietf.org/html/draft-ietf-json-rfc4627bis-04#section-8.3>.  String Comparison

   equal.

>From this it would appear that the only thing that we say differently is to explicitly state that normalization is not to be done before the comparison is made.  It is implicit in the JSON text rather than explicit.

a.      When comparing member names, one needs to follow the rules of Section 8.3 in JSON [rfc4627bis].

b.      When comparing member values, one uses the same comparison rules as those for comparing member names.

2.      The recommendations for expert reviewers need to make a statement that if there are multiple normalizations for a string in the registry, the same string with a different normalization MUST NOT be permitted.

3.      There may be someplace that we need to make a general statement, possibly in section 8.3 that says that when using values from the registry, the registry normalization needs to be used.

Jim

---

From: "Jim Schaad" <[email-masked]>
Date: Mon, 11 Nov 2013 16:51:20 -0800

I haven't see anyone complaining on this way forward.

Section 5.3

Processing of a JOSE object inevitably requires comparing know strings to
members and values in a JSON object.  For example, in checking what the
algorithm is, the Unicode string "alg" will be checked against the member
names in a JWS Header to see if there is a matching Header Parameter name.
The same process is then used to determine if the value of the 'alg' Header
Parameter represents a supported algorithm.

Since the only issues that need to be dealt with are equality and
in-equality, the same set of rules can be used for comparing both the member
name and the member value against known strings.  The rules for doing the
member name comparison are found in section 8.3 of [draft-json-bis].

From: [email-masked] [mailto:[email-masked]] On Behalf Of Jim
Schaad
Sent: Monday, November 04, 2013 11:45 AM
To: [email-masked]
Subject: [jose] FW: Issue #81 - String Comparison Rules

Not in the archive

 

Jim