C2SP / C2SP/CCTV

RFC 8785 (JCS) canonicalization vectors: are they in scope for CCTV

Open
#30 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
107
Forks
16
PR merge metrics
No merged PRs in 30d

Description

CCTV says all cryptography-related test vectors are welcome, so is RFC 8785 JSON canonicalization in scope here?

The case for scope is the one the ed25519 README already makes about signature edge cases. Canonicalization is not itself a security property. Still, 2 implementations that disagree about it emit different bytes, and a signature over one then fails against the other. Across 5 independent implementations the disagreements I hit fell in 3 places. They were number formatting at the double range edges, surrogate and noncharacter handling, and nesting depth. The specification does not bound nesting depth at all, which is where a corpus helps most.

I would contribute 1 JSON file of documents paired with their canonical serializations, in the ed25519 directory layout. A no is a fine answer, and I would keep the vectors where they are and point at CCTV from their README.

Contributor guide

No contributing guide indexed for this repository

Research direction

Read RFC 8785 and the existing ed25519 README and directory layout to determine how cryptography test vectors are organized. Review the proposed cases for number-format edges, surrogate and noncharacter handling, and nesting depth; done means either adding the JSON document/serialization corpus in that layout if accepted, or leaving the vectors elsewhere and pointing to CCTV from the README.

Written by the indexing model from the issue text.

Assessment

Tech stack
json
Domain
cryptography
Issue type
Feature
Difficulty
3/5
Estimated time
1-2 days
Activity status
Active
Clarity
Needs clarification
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.