Subject: [jose] "x5c" - JSON Compatible?

From: Anders Rundgren <[email-masked]>
Date: Tue, 13 Jan 2015 11:03:44 +0100

The spec claims the following:

   "Note that since these strings contain base64 encoded
   (not base64url encoded) values, they are allowed to contain
   white space and line breaks."

Is this really JSON compliant?

I didn't interpret the JSON spec in that way and Python and Chrome seems to agree with me.

What's I'm missing here?

Cheers
Anders

---

From: Richard Barnes <[email-masked]>
Date: Tue, 13 Jan 2015 11:35:37 +0000

> I didn't interpret the JSON spec in that way and Python and Chrome seems

Are you seriously suggesting that JSON strings can't contain white space?

Control characters have to be escaped, but they can definitely be there.

JSON.parse('["this is...\\u000A...a string"]')

--Richard

>
> Cheers
> Anders
>
> _______________________________________________
> jose mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/jose
>

---

From: Anders Rundgren <[email-masked]>
Date: Tue, 13 Jan 2015 13:13:40 +0100

On 2015-01-13 12:35, Richard Barnes wrote:
>
>
> On Tuesday, January 13, 2015, Anders Rundgren <[email-masked] <mailto:[email-masked]>> wrote:
>

Sure, but the example in appendix B wouldn't parse.
Shouldn't a proper text say that possible line-breaks MUST be properly escaped.

Anders

>
> --Richard
>
>
>     Cheers
>     Anders
>
>     _________________________________________________
>     jose mailing list
>     [email-masked]
>     https://www.ietf.org/mailman/__listinfo/jose <https://www.ietf.org/mailman/listinfo/jose>
>

---

From: Mark Watson <[email-masked]>
Date: Tue, 13 Jan 2015 08:52:46 -0800

On Tue, Jan 13, 2015 at 4:13 AM, Anders Rundgren <
[email-masked]> wrote:

>> On Tuesday, January 13, 2015, Anders Rundgren <
>> [email-masked] <mailto:[email-masked]>>
>> wrote:
>>

​Line breaks in JSON do have to be escaped, either as above or with \r \n.
This is clear at www.json.org.

…Mark​

>>     https://www.ietf.org/mailman/__listinfo/jose <
>> https://www.ietf.org/mailman/listinfo/jose>
>>
>>

---

From: Mike Jones <[email-masked]>
Date: Tue, 13 Jan 2015 18:33:09 +0000

We should add the standard disclaimer “(with line breaks within values for display purposes only)” to the description of the example.

                                                            -- Mike

From: jose [mailto:[email-masked]] On Behalf Of Mark Watson
Sent: Tuesday, January 13, 2015 8:53 AM
To: Anders Rundgren
Cc: Richard Barnes; [email-masked]
Subject: Re: [jose] "x5c" - JSON Compatible?

On Tue, Jan 13, 2015 at 4:13 AM, Anders Rundgren <[email-masked]<mailto:[email-masked]>> wrote:
On 2015-01-13 12:35, Richard Barnes wrote:

On Tuesday, January 13, 2015, Anders Rundgren <[email-masked]<mailto:[email-masked]> <mailto:[email-masked]<mailto:[email-masked]>>> wrote:

    What's I'm missing here?

​Line breaks in JSON do have to be escaped, either as above or with \r \n. This is clear at www.json.org<http://www.json.org>.

…Mark​

Anders

--Richard

    Cheers
    Anders

    _________________________________________________
    jose mailing list
    [email-masked]<mailto:[email-masked]>
    https://www.ietf.org/mailman/__listinfo/jose <https://www.ietf.org/mailman/listinfo/jose>

_______________________________________________
jose mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/jose

---

From: Anders Rundgren <[email-masked]>
Date: Tue, 13 Jan 2015 19:52:58 +0100

> We should add the standard disclaimer “(with line breaks within values for display purposes only)” to the description of the example.

Hi Mike,
I would consider something along these lines since Base64 differs from
the other elements:

    The JSON array below is an example of a certificate chain that could
    be used as the value of an "x5c" (X.509 Certificate Chain) Header
    Parameter, per Section 4.1.6.  Note that since these strings contain
    base64 encoded (not base64url encoded) values, they are allowed to
    contain white space and line breaks but JSON [RFC7159] character
    escape rules MUST still be honored.  In the example line breaks
    were added for display purposes only.

      ["MIIE3jCCA8agAwIBAgICAwEwDQYJKoZIhvcNAQEFBQAwYzELMAkGA1UEBhMCVVM
        xITAfBgNVBAoTGFRoZSBHbyBEYWRkeSBHcm91cCwgSW5jLjExMC8GA1UECxMoR2
        8gRGFkZHkgQ2xhc3MgMiBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0wNjExM

Anders

>
>                                                              -- Mike
>
> *From:*jose [mailto:[email-masked]] *On Behalf Of *Mark Watson
> *Sent:* Tuesday, January 13, 2015 8:53 AM
> *To:* Anders Rundgren
> *Cc:* Richard Barnes; [email-masked]
> *Subject:* Re: [jose] "x5c" - JSON Compatible?
>
> On Tue, Jan 13, 2015 at 4:13 AM, Anders Rundgren <[email-masked] <mailto:[email-masked]>> wrote:
>
> On Tuesday, January 13, 2015, Anders Rundgren <[email-masked] <mailto:[email-masked]> <mailto:[email-masked] <mailto:[email-masked]>>> wrote:
>
> ​Line breaks in JSON do have to be escaped, either as above or with \r \n. This is clear at www.json.org <http://www.json.org>.
>
> …Mark​
>
>
>     Anders
>
>
>     --Richard
>
>
>          Cheers
>          Anders
>
>     [email-masked] <mailto:[email-masked]>
>     [email-masked] <mailto:[email-masked]>

---

From: John Bradley <[email-masked]>
Date: Tue, 13 Jan 2015 16:49:39 -0300

Mike,

According to [RFC4648] Section 4 <https://tools.ietf.org/html/rfc4648#section-4>  whitespace are not valid base64 encoding characters.  

Older PEM specifications required breaking up into lines of 64 characters.   Most base64 decoders ignore whitespace to be backwards compatible, but that doesn't make whitespace valid to produce.

Some software like openSSL will need the strings "-----BEGIN CERTIFICATE-----" and "-----END CERTIFICATE-----" appended and line breaks added for import.

I don't see the text about including line breaks in the current draft 39 Sec 4.7. of JWK.

I think the only thing required is the note about line breaks within values being for display only is all that is needed.

So no whitespace in the value and applications add it if required for importing as a PEM encoded cert.

John B.

On Jan 13, 2015, at 3:33 PM, Mike Jones <[email-masked]> wrote:[RFC4648] Section 4 <https://tools.ietf.org/html/rfc4648#section-4>
> From: jose [mailto:[email-masked] <mailto:[email-masked]>] On Behalf Of Mark Watson
> Cc: Richard Barnes; [email-masked] <mailto:[email-masked]>
> ​Line breaks in JSON do have to be escaped, either as above or with \r \n. This is clear at www.json.org <http://www.json.org/>.
>  
> …Mark​
>  
>  
> 
> Anders
> 
> 
> --Richard
> 
> 
>     Cheers
>     Anders
> 
>     https://www.ietf.org/mailman/__listinfo/jose <https://www.ietf.org/mailman/__listinfo/jose> <https://www.ietf.org/mailman/listinfo/jose <https://www.ietf.org/mailman/listinfo/jose>>
> 
> 
> https://www.ietf.org/mailman/listinfo/jose <https://www.ietf.org/mailman/listinfo/jose>
>  
> https://www.ietf.org/mailman/listinfo/jose <https://www.ietf.org/mailman/listinfo/jose>

---

From: Mike Jones <[email-masked]>
Date: Tue, 13 Jan 2015 21:15:27 +0000

Then we also need to delete this sentence in http://tools.ietf.org/html/draft-ietf-jose-json-web-signature-39#appendix-B, since it’s incorrect:

   Note that since these strings contain
   base64 encoded (not base64url encoded) values, they are allowed to
   contain white space and line breaks.

Thanks for the last-minute catch!

                                                            -- Mike

From: John Bradley [mailto:[email-masked]]
Sent: Tuesday, January 13, 2015 11:50 AM
To: Mike Jones
Cc: Anders Rundgren; [email-masked]
Subject: Re: [jose] "x5c" - JSON Compatible?

Mike,

According to [RFC4648] Section 4<https://tools.ietf.org/html/rfc4648#section-4>  whitespace are not valid base64 encoding characters.

John B.

On Jan 13, 2015, at 3:33 PM, Mike Jones <[email-masked]<mailto:[email-masked]>> wrote:[RFC4648] Section 4<https://tools.ietf.org/html/rfc4648#section-4>

                                                            -- Mike

From: jose [mailto:[email-masked]] On Behalf Of Mark Watson
Sent: Tuesday, January 13, 2015 8:53 AM
To: Anders Rundgren
Cc: Richard Barnes; [email-masked]<mailto:[email-masked]>
Subject: Re: [jose] "x5c" - JSON Compatible?

    What's I'm missing here?

​Line breaks in JSON do have to be escaped, either as above or with \r \n. This is clear at www.json.org<http://www.json.org/>.

…Mark​

Anders

--Richard

    Cheers
    Anders

---

From: John Bradley <[email-masked]>
Date: Tue, 13 Jan 2015 18:50:28 -0300

Yes that conflicts with the correct definition of x5c in JWK.

John B.
> On Jan 13, 2015, at 6:15 PM, Mike Jones <[email-masked]> wrote:
> 
> Then we also need to delete this sentence in http://tools.ietf.org/html/draft-ietf-jose-json-web-signature-39#appendix-B <http://tools.ietf.org/html/draft-ietf-jose-json-web-signature-39#appendix-B>, since it’s incorrect:
>  
> On Jan 13, 2015, at 3:33 PM, Mike Jones <[email-masked] <mailto:[email-masked]>> wrote:[RFC4648] Section 4 <https://tools.ietf.org/html/rfc4648#section-4>
>

---

From: Anders Rundgren <[email-masked]>
Date: Wed, 14 Jan 2015 08:35:37 +0100

>     contain white space and line breaks.

Good!

So then the only remaining issue may be how to cope with the fragmentation
that will occur if the JOSE WG ignores the XML to JSON converts who can't
imagine dressing business messages in Base64URL:
https://openkeystore.googlecode.com/svn/wcpp-payment-demo/trunk/docs/messages.html#UserAuthorizesTransaction

Cheers,
Anders
https://mobilepki.org/jcs

> *From:*John Bradley [mailto:[email-masked]]
> *Sent:* Tuesday, January 13, 2015 11:50 AM
> *To:* Mike Jones
> *Cc:* Anders Rundgren; [email-masked]
>     *From:*jose [mailto:[email-masked]]*On Behalf Of*Mark Watson
>     *Sent:*Tuesday, January 13, 2015 8:53 AM
>     *To:*Anders Rundgren
>     *Cc:*Richard Barnes;[email-masked] <mailto:[email-masked]>
>     *Subject:*Re: [jose] "x5c" - JSON Compatible?
>
>     On Tuesday, January 13, 2015, Anders Rundgren <[email-masked] <mailto:[email-masked]><mailto:[email-masked] <mailto:[email-masked]>>> wrote:
>
>     ​Line breaks in JSON do have to be escaped, either as above or with \r \n. This is clear atwww.json.org <http://www.json.org/>.
>
>     …Mark​
>
>
>         Anders
>
>
>         --Richard
>
>
>              Cheers
>              Anders
>
>         https://www.ietf.org/mailman/__listinfo/jose<https://www.ietf.org/mailman/listinfo/jose>
>
>