Canonicalization (JCS)
Canonicalization brings data into a unique, defined representation so hashes and signatures always come out the same regardless of formatting; for JSON, RFC 8785 describes the JSON Canonicalization Scheme (JCS).
The same JSON object can be written in many ways: with a different field order, with spaces, with different number representations. For people it is the same, for a hash it is not. Canonicalization defines a single representation, such as sorted fields and no superfluous spaces. RFC 8785 describes this for JSON, and the signature base under RFC 9421 fulfills the same role for HTTP requests.
For evidence, canonicalization is the precondition for a hash, for example in a manifest or a receipt chain, being recomputed identically by every verifying party.
Example
A receipt chain stores for each entry the hash over the canonical form of its predecessor. If a system later reformats the entries, the canonical form stays the same, and the chain can still be verified. If someone changes an amount, the hash changes, and the chain breaks.
How it differs
Canonicalization changes no content, only the representation. A signature protects the canonical form; a signature base under RFC 9421 is the canonical form of an HTTP request.
In practice
- Always hash and sign JSON in canonical form, never in a library's arbitrary output.
- Document which canonicalization procedure you use.
- Test with data in different formatting whether the hash stays the same.
Role in KYA
KYA computes hashes in evidence packs, receipt chains and the certificate's reportDigest over canonical forms. That is why the same input yields the same value everywhere.
Related check: Cryptographic integrity (cryptographic_integrity). Are signatures, disclosures, hash chains and manifest unchanged?
Frequently asked questions
What is canonicalization?
Converting data into a unique representation so hashes and signatures come out the same regardless of formatting.
What is JCS?
The JSON Canonicalization Scheme under RFC 8785. It defines how JSON is written uniquely, for example with sorted fields and fixed number representations.
Why does evidence need canonicalization?
Because otherwise a hash comes out differently after every reformatting. Only with a canonical form can every verifying party recompute the same value.
Is the RFC 9421 signature base also a canonicalization?
Yes, at its core. It defines which parts of an HTTP request are signed in which form.
Where does KYA use canonicalization?
For evidence pack manifests, receipt chains and the certificate's reportDigest, which can therefore be recomputed reproducibly.
Which mistakes commonly occur in canonicalization?
Different number representations, Unicode characters in different forms and libraries that do not sort fields. Tests with deliberately differently formatted data uncover such mistakes early.