RFC 8785 (JCS) canonicalization vectors: are they in scope for CCTV
- Dominant language
- Go
- Stars
- 107
- Forks
- 16
- PR merge metrics
- No merged PRs in 30d
Description
CCTV says all cryptography-related test vectors are welcome, so is RFC 8785 JSON canonicalization in scope here?
The case for scope is the one the ed25519 README already makes about signature edge cases. Canonicalization is not itself a security property. Still, 2 implementations that disagree about it emit different bytes, and a signature over one then fails against the other. Across 5 independent implementations the disagreements I hit fell in 3 places. They were number formatting at the double range edges, surrogate and noncharacter handling, and nesting depth. The specification does not bound nesting depth at all, which is where a corpus helps most.
I would contribute 1 JSON file of documents paired with their canonical serializations, in the ed25519 directory layout. A no is a fine answer, and I would keep the vectors where they are and point at CCTV from their README.
Contributor guide
No contributing guide indexed for this repository
Research direction
Read RFC 8785 and the existing ed25519 README and directory layout to determine how cryptography test vectors are organized. Review the proposed cases for number-format edges, surrogate and noncharacter handling, and nesting depth; done means either adding the JSON document/serialization corpus in that layout if accepted, or leaving the vectors elsewhere and pointing to CCTV from the README.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- json
- Domain
- cryptography
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Active
- Clarity
- Needs clarification
- Newbie friendliness
- 45/100