Ciao Mauro, Hi all, As I already wrote, flat JSON arrays provide a massive advantage to CRITIS environments: predictable parsing time.
1. Nesting: Deeply nested objects force standard parsers into recursive allocation. This is crucial with a real load in productive, possibly CRITIS environments, provoking unpredictable errors under a DDoS attack. A flattened array strictly limits nesting to level 1 at the structural layer, allowing immediate wire-speed drops. 2. Hash Flooding: Standard parsers allocate internal hash maps to resolve name/value pairs, making them vulnerable to engineered collision attacks. A flattened JSON array requires zero hash map allocation. It is processed as a pure linear stream. Algorithmic key-flooding becomes structure. Best regards, Timo It looks like Mauro De Gennaro aimed to say: > Hi Timo, > >> A flattened JSON array forces strict sequential determinism. >> It ensures that duplicate context tags cannot overwrite each >> other or create ambiguous parsing paths. >> >> Regarding predictable parsing time: Sterile lab setups do not >> simulate a CRITIS gateway under a DDoS attack. Deeply nested JSON >> opens the door to algorithmic complexity exploits. An array >> guarantees linear O(n) parsing time at wire speed. >> >> My idea of a flat array reduces the attack surface to the >> smallest possible level. It provides security by design, rather >> than security by policy. > > On flattening as a DoS mitigation: changing the schema does not change what > arrives on the wire. An attacker sending a hostile value is not emitting > schema-conformant JSON. They will send 10,000 levels of nesting whether the > spec describes nested objects or a flat array. A verifier therefore has to > bound depth and input length at the parser under either design, and since the > mitigation is identical either way, flattening buys no additional resistance. > > Regarding linear time, a conforming JSON parser makes a single pass and > consumes each token exactly once, regardless of shape. Nesting depth > determines how much parser stack is live at a given moment, not how many > times any byte is examined. Nested JSON is already O(n) in input length, so > the guarantee you want from the array is one the current design has. JSON > also cannot express the expansion attacks that motivate this worry in other > formats, because it has no entity or anchor references; output size is > bounded by input size. > Also, about algorithmic complexity attacks specifically, in JSON these are > normally hash flooding, many colliding keys within a single object degrading > insertion. That depends on key count per object, not on depth, so flattening > does not mitigate it. > > > Best, > Mauro > > > > _______________________________________________ > Ietf-dkim mailing list -- [email protected] > To unsubscribe send an email to [email protected] Timo Gerke Hamburg, Germany "If you think technology can solve your security problems then you don't understand the problems and you don't understand the technology." -- Bruce Schneier
OpenPGP_0x9F03DF9F597BF31E.asc
Description: OpenPGP public key
OpenPGP_signature.asc
Description: OpenPGP digital signature
_______________________________________________ Ietf-dkim mailing list -- [email protected] To unsubscribe send an email to [email protected]
