Hi Hannah, hi all, I am reffering to OWASP Top 10 A06:2025 Insecure Design [1] and OWASP Top 10 A04:2025 Cryptographic Failures [2].
1. Strict, Deterministic Input Validation: OWASP mandates unambiguous data models. By forcing nested JSON, the spec imports RFC 8259, Section 4 (duplicate keys are "undefined"). This structural ambiguity actively provokes flawed input validation. 2. Bounding Worst-Case Resource Consumption: The guidance requires protecting gateways against resource exhaustion. Nested JSON layouts allows an algorithmic complexity DoS attack. 3. Invariance of Security Controls: Data interpretation must remain identical across all layers. The spec encourages parsing differentials between security gateways and downstream systems, directly bypassing the cryptographic integrity of the signature. To satisfy the guidances, a secure architecture mandates a flattened, linear O(n) layout, in my opinion. Regards, Timo [1] https://top10.owasp.org/2025/A06_2025-Insecure_Design/ [2] https://top10.owasp.org/2025/A04_2025-Cryptographic_Failures/ It looks like Hannah Stern aimed to say: > Hi! > > On 9/10/26 19:36, Timo Gerke wrote: >> Hi Bron, Richard and Wei, >> >> I suggest you SHOULD consider reading the OWASP Top 10: Insecure >> Design Guide before declaring the current recipe architecture ready. > Could you be more precise? > > What OWASP guidance specifically are you referring to? In what way could > the current spec mandate or encourage implementations violating such > guidance? > > Hannah. Timo Gerke Hamburg, Germany "If you think technology can solve your security problems then you don't understand the problems and you don't understand the technology." -- Bruce Schneier
OpenPGP_0x9F03DF9F597BF31E.asc
Description: OpenPGP public key
OpenPGP_signature.asc
Description: OpenPGP digital signature
_______________________________________________ Ietf-dkim mailing list -- [email protected] To unsubscribe send an email to [email protected]
