<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">How to do string comparisons seems a bit like stepping on the toes of whatever spec is using JSON Simple Sign.<div><br></div><div>Not that it is not good advice.</div><div><br></div><div>I think we can require that for our reserved elements like algorithm.</div><div><br></div><div>All of the elements are signed so I think it is more an interop issue than a security one. If an attacker changes the element name the signature won't verify.</div><div><br></div><div>The real problem is the RP and issuer processing the unicode differently and the RP not finding the required element.</div><div><br></div><div>I would have thought though that the issue was well understood in JSON generally. </div><div><br></div><div>One thing they do have that I like is a clear way of naming extension elements.</div><div><br></div><div>We may want to think about saying all extension elements need to be URI named to avoid collisions. I think that is simpler than a registry.</div><div><br></div><div>John B.</div><div><br></div><div><br><div><div>On 2010-10-04, at 11:13 PM, Nat Sakimura wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite">For JSON Simple Sign, <span class="Apple-style-span" style="font-family: verdana, charcoal, helvetica, arial, sans-serif; "><h3 style="font-family: helvetica, monaco, 'MS Sans Serif', arial, sans-serif; font-weight: bold; font-style: normal; color: rgb(51, 51, 51); background-color: transparent; ">
9.1. Unicode Comparison Security Issues</h3><div>that is stated in </div><div><br></div><div><a href="http://self-issued.info/docs/draft-goland-json-web-token-00.html">http://self-issued.info/docs/draft-goland-json-web-token-00.html</a></div>
<div><br></div><div>may be relevant. We may want to include something like that as well. </div><div><br></div><div>What do you think? > John</div></span><br>-- <br>Nat Sakimura (=nat)<br><a href="http://www.sakimura.org/en/">http://www.sakimura.org/en/</a><br>
<a href="http://twitter.com/_nat_en">http://twitter.com/_nat_en</a><br>
_______________________________________________<br>Openid-specs-ab mailing list<br><a href="mailto:Openid-specs-ab@lists.openid.net">Openid-specs-ab@lists.openid.net</a><br><a href="http://lists.openid.net/mailman/listinfo/openid-specs-ab">http://lists.openid.net/mailman/listinfo/openid-specs-ab</a><br></blockquote></div><br></div></body></html>