search

rfcs / crypto-conditions

Composable cryptographic conditionals (signatures, hashes)
https://tools.ietf.org/html/draft-thomas-crypto-conditions-03
22 stars 12 forks source link

&subtypes= sorting in test vectors #32

Open ssadler opened 6 years ago

ssadler commented 6 years ago

The RFC document says of the subtypes parameter in the URI:

The list MUST be ordered by the type id value of each type, in ascending order. i.e. preimage-sha-256 MUST appear before prefix-sha-256.

This appears to be incorrect in the test vectors and also in the javascript code, which just uses the javascript .sort() method on the subtype names. Unless I'm missing something?

I'm working on a new implementation of crypto-conditions, I'll try to make a PR with some changes when it's more complete.

sappenin commented 6 years ago

This quote above is no longer correct. Draft4 of the spec now says:

The parameters of a condition URI MUST appear in ascending lexicographical order based upon the name of each parameter. For example, the "cost" parameter must appear before the "fpt" parameter, which must appear before the "subtypes" parameter.

sappenin commented 6 years ago

@libscott I'm just realizing my comment above doesn't actually address your problem -- I think you are right that the RFC test-vectors are wrong in certain places when it comes to subtypes= sorting.

For example, here's the latest commit into many of the test-vectors, but it doesn't fix these for draft4 query-param ordering.

In the Java implementation, we have a corrected fork of these vectors, but relying on this data in the Java lib is incorrect and needs to be fixed -- we should instead be relying on the test vectors from this project (refer to https://github.com/hyperledger/quilt/issues/101 for tracking that).

ssadler commented 6 years ago

@sappenin Yea, it's a bit ambiguous. You can't really target version 03 of the spec, unless you correct the vectors yourself as you say. I'm not sure if it's easy to target version 04 - the asn definition hasn't changed in over a year, since version 02, and the rfc document itself is still at version 03, even though the vectors are not.