In the system that I am building, users create their own public JSON files on the Internet, available to anyone. My system does not store these JSON files nor have anything except read only access to those files.

When my software grabs one of these JSON files and examines it, I need to know which of my users that file belongs to.

I have a vague idea of a solution but I'd like some feedback:

I will require the user to include a field in the JSON containing some bit of signed information, perhaps their userid. My software provides the user with this string of information to include in their JSON.

In my software, the user must specify the URL that the JSON can be found at. This allows me to ignore any JSON files where the user has not also specified the URL.

Thoughts? Does this make sense? Any issues? thanks!

  • Nah, you need to sign the whole file. However, if the user needs to specify the whole URL you could improvise a scheme like this: The filename contains the Hash of the file contents. – mroman Sep 16 '16 at 7:09

No, I am afraid it does not make sense. If you sign only parts of it, anybody can copy that sign Part in his JSON.

It would be better to sign the whole JSON, by calculating a hash of it and then sign that. That way nobody can alter it without having to sign it again.

| improve this answer | |

It makes sense that a user has to sign the whole file. If there is a signed part in there that everyone can copy, you can just use the username in plain text and trust that no one will copy that!

| improve this answer | |

The key in signing data is that any change to data shall make the signature invalid, and that only the owner of the secret can sign data.

Here you can use two ways:

  • sign the json file itself in a auxilliary file. Pros: simple to setup - cons: non significative changes to the json (add a space outside a string for example) still require a new signature file and you need to load the auxilliary file along with the json one
  • add a sign field to the original json that will contain the signature of a concatenation of all data in a precise format. Pros: only one file and the actual data is signed not a particular json representation. Cons: every client must be able to build the representation and sign it.
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.