search

paseto-standard / test-vectors

Test vectors for PASETO, PASERK, etc.
Other
6 stars 4 forks source link

Test Vectors Without JSON Encoding Order Dependency #10

Closed aidantwoods closed 2 years ago

aidantwoods commented 2 years ago

JSON encoders don't guarantee key order when encoding, so this is slightly problematic when JSON decoding and then re-encoding the payload in the test vectors (in Swift at least, the order ends up being reverse alphabetical). The test vectors all seem to be encoded with the exp key first, data second. Edit: sorry, it is the other way round—point still stands about undefined order though :)

In order to help test Paseto implementations independently of the available JSON parser, my suggestion would be to either include the raw string to be encrypted/signed instead of the current JSON form (i.e. embed the already encoded JSON in a string), or to make it available as an additional key (e.g. payload-raw). This will avoid the need for implementations to modify the test vectors to be compatible with their JSON encoder, or come up with other more error prone solutions.

Happy to make a PR for this, just need some indication on which method is preferred (two keys or just the one).

aidantwoods commented 2 years ago

I'm noting that both the footer and implicit-assertion keys both point to already encoded JSON, so my thinking is that it may make the most sense to keep this pattern and adjust the data under the payload key?