Hi Timo, > A flattened JSON array forces strict sequential determinism. > It ensures that duplicate context tags cannot overwrite each > other or create ambiguous parsing paths. > > Regarding predictable parsing time: Sterile lab setups do not > simulate a CRITIS gateway under a DDoS attack. Deeply nested JSON > opens the door to algorithmic complexity exploits. An array > guarantees linear O(n) parsing time at wire speed. > > My idea of a flat array reduces the attack surface to the > smallest possible level. It provides security by design, rather > than security by policy.
On flattening as a DoS mitigation: changing the schema does not change what arrives on the wire. An attacker sending a hostile value is not emitting schema-conformant JSON. They will send 10,000 levels of nesting whether the spec describes nested objects or a flat array. A verifier therefore has to bound depth and input length at the parser under either design, and since the mitigation is identical either way, flattening buys no additional resistance. Regarding linear time, a conforming JSON parser makes a single pass and consumes each token exactly once, regardless of shape. Nesting depth determines how much parser stack is live at a given moment, not how many times any byte is examined. Nested JSON is already O(n) in input length, so the guarantee you want from the array is one the current design has. JSON also cannot express the expansion attacks that motivate this worry in other formats, because it has no entity or anchor references; output size is bounded by input size. Also, about algorithmic complexity attacks specifically, in JSON these are normally hash flooding, many colliding keys within a single object degrading insertion. That depends on key count per object, not on depth, so flattening does not mitigate it. Best, Mauro
_______________________________________________ Ietf-dkim mailing list -- [email protected] To unsubscribe send an email to [email protected]
