[Event Service] Some events can't be validated

[boreq]

Is this because of other implementations garbling up the events or our implementation incorrectly handling JSON?

Example of such event:

• id 61400832313a1d69dfee07bbf2990f5338d3c77cd5beaa047289bea65d1b5532
• relay wss://kukks.org/nostr

Also when will people finally stop trying to sign JSON 😢 ?

[boreq]

See:

• JSON serialization for deriving event.id is not adequately specified nostr-protocol/nips#354

[boreq]

I will paste this in here since I started writing it before I found an existing issue for this.

---

The JSON format is defined in the ECMA-404 standard.

NIP-01 describes the algorithm for serializing events as an array of JSON Values (as described by section 5 "JSON Values" of ECMA-404). This algorithm results in creating a JSON array with various event fields. Creating this array is a prerequisite to calculating the event id and then validating the event signature.

Section 9 of ECMA-404 document titled "String" doesn't define a deterministic way of serializing sequences of Unicode code points as JSON strings. For example a sequence of Unicode codepoints consisting only of the solidus character (U+002F) can be encoded as either one of the following JSON strings (as shown in the document):

• "\u002F"
• "\u002f"
• "\/"
• "/"

This leads to the lack of determinism when creating event signatures of nostr events. Which one of the following JSON arrays should be hashed and signed in order to create the event signature of an event with the aforementioned content?

• [0,"e731ca427c18059d66636ddfaeeeb15012bc2db3cdd27b9e4cade5057a6e82ed",123,1,[],"\u002F"]
• [0,"e731ca427c18059d66636ddfaeeeb15012bc2db3cdd27b9e4cade5057a6e82ed",123,1,[],"\u002f"]
• [0,"e731ca427c18059d66636ddfaeeeb15012bc2db3cdd27b9e4cade5057a6e82ed",123,1,[],"\/"]
• [0,"e731ca427c18059d66636ddfaeeeb15012bc2db3cdd27b9e4cade5057a6e82ed",123,1,[],"/"]

Mind that this property of the JSON format makes any action of deserializing a JSON object representing an event and then reserializing it as a JSON object a destructive operation which may corrupt the event. For example if an implementation chooses to deserialize the event received as ["EVENT", {...}] from a relay and then construct the aformentioned array used for ID calculation in order to verify the event signature it is likely that for some events this operation will lead to failures. This is already how existing implementations operate (e.g. github.com/nbd-wtf/go-nostr).

I wanted to write this down to get the discussion started on what the way out of this is:

• specifying a deterministic way of encoding the serialized event array as a JSON-like format?
• switching to a different binary-based format?