search

openid / OpenID4VP

56 stars 20 forks source link

Small (and optional) editorial SD-JWT+KB's spec suggestion: remove whitespace from examples of JSON serialization #325

Open samuelgoto opened 3 days ago

samuelgoto commented 3 days ago

I couldn't find where to file issues for the SD-JWT+KB, so sending this here -- feel free to ignore this or ask me to move it to a more appropriate please

Just a small note, as I was reading along the SD-JWT+KB and ran into a problem implementing this section:

https://www.ietf.org/archive/id/draft-ietf-oauth-selective-disclosure-jwt-13.html#section-4.2.1-2.2

The problem is that in this section, my JSON serializer (and I think, most people's web-based JSON.stringy()-based serializer) removes white space between array elements. 

So, I was getting ["_26bc4LT-ac6q2KI6cBW5es","family_name","Möbius"] rather than ["_26bc4LT-ac6q2KI6cBW5es", "family_name", "Möbius"], which base64url encodes to WyJfMjZiYzRMVC1hYzZxMktJNmNCVzVlcyIsImZhbWlseV9uYW1lIiwiTcO2Yml1cyJd rather than WyJfMjZiYzRMVC1hYzZxMktJNmNCVzVlcyIsICJmYW1pbHlfbmFtZSIsICJNw7ZiaXVzIl0 as is in the example.

Since it wasn't matching what was in the spec, I had to debug for a while before I convinced myself that my implementation was valid, so figured other people would too.

bc-pi commented 3 days ago

There is a note at https://www.ietf.org/archive/id/draft-ietf-oauth-selective-disclosure-jwt-13.html#name-discussion-venues that points to this repo at https://github.com/oauth-wg/oauth-selective-disclosure-jwt which would probably be a more appropriate place due to it being the repo for SD-JWT.

That said, there are a ton of other arrays in that draft that also have space between elements. One of the main reasons for the base64url encoded stuff as the input to integrity calculations is the tolerance for (or not having to deal with) different JSON representations that are semantically equivalent.