Encode bytes, then verify
05UTF-8 makes the canonical text into platform-independent bytes. A signature scheme must still validate its input, application rules and cryptographic proof before acting.
Alternative case: I-JSON, application conventions and the signature all pass. Only now may the application act under its own authorization policy.
Source for this drawing: RFC 8785 · Read RFC section 3.2.4 ↗
New to this? Start hereA quick picture + helpful background
First, agree how to read the message.
An encoding tells a reader how to interpret bytes. A format tells it how values fit together. Correctly reading a value does not make that value trustworthy.
Helpful first, if these ideas are unfamiliar
These pictures are analogies to help you learn. The linked RFC explains the actual rules.
Terms in this drawing
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
Identical bytes help verification; they do not authenticate themselves.
- The canonical result MUST be encoded in UTF-8. Sending canonical JSON as the wire format is optional; endpoints can canonicalize an ordinary representation themselves.
- For signature schemes like Appendix F, applications MUST parse and check I-JSON, check correctness under the ecosystem conventions (including locating the signature), and verify the signature before acting. If any step fails, the operation MUST be aborted.
- Appendix F illustrates saving/removing a designated signature property before canonicalizing the remaining data, then verifying with the appropriate algorithm/key. It does not define one universal signature property, key-discovery or authorization policy.
The byte example is the complete UTF-8 encoding of {"x":"é"}; no hash or signature is fabricated. The last three states are a separate signature-processing illustration: ordinary parsing first, an application-rule failure that stops before signature verification, and an alternative fully checked path. Success assumes the application’s algorithm/key policy and other authorization checks.
Read the RFC section ↗