@@ -2690,31 +2690,6 @@ <h3>Transformations</h3>
2690
2690
Implementers are advised to consider these sorts of attacks when implementing
2691
2691
defensive security strategies.
2692
2692
</ p >
2693
- < p class ="issue "
2694
- title ="Collision-resistant canonicalization requirements ">
2695
- The VCWG is seeking feedback on normative language that cryptographic suite
2696
- implementers need to follow to ensure that they do not utilize data
2697
- transformation mechanisms that can map to the same output. That is, given
2698
- different inputs for canonicalization scheme #1 and canonicalization scheme #2,
2699
- they must not produce the same output value. As an analogy, this is the same
2700
- requirement for cryptographic hashing mechanisms and is why those schemes are
2701
- designed to be collision resistant. Cryptographic canonicalization mechanisms
2702
- have the same requirement. At present, this isn't a problem because the three
2703
- expected canonicalization schemes — the Universal RDF Dataset
2704
- Canonicalization Algorithm 2015 [[?RDF-CANON]], JSON Canonicalization
2705
- Scheme [[?RFC8785]], and a theoretical future base-encoding canonicalization
2706
- — have entirely different outputs.
2707
- </ p >
2708
- < p class ="issue "
2709
- title ="Avoiding the pitfalls of XML Canonicalization ">
2710
- The VCWG is seeking feedback on whether to explain why modern canonicalization
2711
- schemes are simpler than the far more complex XML Canonicalization schemes of
2712
- the early 2000s. Some readers seem to be under the impression that all
2713
- canonicalization is difficult and has to be avoided at all costs (including costs
2714
- to application developers). The WG would like to understand if it would be helpful
2715
- to include a section explaining why some simpler data syntaxes (such as JSON) are
2716
- easier to canonicalize than more complex data syntaxes (such as XML).
2717
- </ p >
2718
2693
</ section >
2719
2694
2720
2695
< section >
0 commit comments