Subject: New Signatures Draft

From: Justin Richer <[email-masked]>
Date: Mon, 15 Mar 2021 16:10:43 -0400

We’ve published a new version of the Signatures draft:

https://www.ietf.org/archive/id/draft-ietf-httpbis-message-signatures-02.html <https://www.ietf.org/archive/id/draft-ietf-httpbis-message-signatures-02.html>

It’s been a while since the last publication, and there are a lot of big changes from the -01 version. The short version:

 - Two headers, one for signature inputs and one for the signature itself
 - Headers both use Structure Field syntax
 - Signature base string generation mechanism uses Structured Field composition rules
 - Signature now always covers the signature metadata (this alone solved about a half dozen reported problems, at least)

It’s still a bit drafty, but it’s implementable: I’ve managed to implement the client and server side of this in Java, thanks to Julian’s Structured Fields library on that platform. 

 — Justin

---

From: Roberto Polli <[email-masked]>
Date: Tue, 16 Mar 2021 18:45:33 +0100

Hi Justin,

Il giorno lun 15 mar 2021 alle ore 21:12 Justin Richer
<[email-masked]> ha scritto:
> https://www.ietf.org/archive/id/draft-ietf-httpbis-message-signatures-02.html

great work!

> It’s still a bit drafty, but it’s implementable: I’ve managed to implement the client and server side of this in Java, thanks to Julian’s Structured Fields library on that platform.

Could you link the repo svp?

Peace,
R.

---

From: Justin Richer <[email-masked]>
Date: Wed, 17 Mar 2021 16:07:00 -0400

> Could you link the repo svp?

Sure, it’s part of my Java implementation of the GNAP protocol, called XYZ. The relevant changes are all in this PR:

https://github.com/bspk/oauth.xyz-java/pull/12 <https://github.com/bspk/oauth.xyz-java/pull/12>

The project had previously implemented the Cavage draft, which you can see in the “before” side of the PR.

 — Justin