RFC 8785 / START HERE
JCS, before the details
JSON Canonicalization Scheme (JCS) defines a repeatable representation of JSON data. Canonicalization means choosing one fixed form for the same parsed data.
JSON lets an object be written in different property orders, with different spacing and number spellings. JCS validates a restricted input profile, sorts object names, uses fixed value spellings and produces UTF-8 bytes.
The idea in one picture
JSON values
Fixed representation
UTF-8 bytes
A simplified picture of the idea; the chapters explain the actual mechanisms.
Why it exists
Hashes and signatures operate on exact bytes. JCS helps producers and consumers obtain the same bytes even when JSON is transmitted in another layout. RFC 8785 is an Informational Independent Submission, not a replacement for JSON or an IETF Standards Track specification.
A familiar example
Imagine checking a signed picnic inventory after its object members were rearranged. Both endpoints can canonicalize the data before verification. Canonicalization does not itself supply a signature, trusted key or permission to use the data; invalid input and changed values still matter.
Helpful background
You can start here without reading another RFC. If these ideas are unfamiliar, these short introductions may help.
What you’ll learn next
Begin with chapter one, or choose a topic.
- Check the input firstCanonical means one repeatable representation of parsed data. First exclude ambiguous names, invalid characters and unsupported numbers.→
- Serialize numbers and literalsDifferent number spellings can parse to the same binary64 value. JCS uses the specified ECMAScript serialization, with no whitespace between tokens.→
- Preserve strings, choose escapesA character can arrive through an escape or directly. Decode it, preserve the resulting Unicode data, then serialize with the required escapes.→
- Sort names, keep array orderObject property order becomes deterministic at every depth. Arrays keep their element order, even while objects inside them have their names sorted.→
- Encode bytes, then verifyUTF-8 makes the canonical text into platform-independent bytes. A signature scheme must still validate its input, application rules and cryptographic proof before acting.→
This introduction explains RFC 8785 (2020). Read the original RFC ↗