Subject: New I-D: HTTP Message Signatures

From: "Richard Backman, Annabelle" <[email-masked]>
Date: Fri, 13 Dec 2019 00:18:36 +0000

Hello HTTP Working Group,

I have just published a new I-D on an old topic, HTTP Message Signatures: https://datatracker.ietf.org/doc/draft-richanna-http-message-signatures/

This document describes a mechanism for creating, encoding, and verifying digital signatures or message authentication codes over content within an HTTP message. This mechanism supports use cases where the full HTTP message may not be known to the signer, and where the message may be transformed (e.g., by intermediaries) before reaching the verifier.

There is growing widespread interest in this topic (see Justin Richer’s SecDispatch presentation at IETF 106); the goal of this draft is to provide a general purpose signing mechanism that can be used directly or profiled to fit specific use cases. This draft is based on draft-cavage-http-signatures-12<https://tools.ietf.org/id/draft-cavage-http-signatures-12.txt>, which has been under independent development for several years. While we have identified several issues with that draft, in the interests of maintaining continuity with that work, we have avoided making normative changes at this time and instead documented these issues as topics for discussion. We would like the HTTP working group to consider adopting this draft, so that this discussion can happen in an open forum, with the right audience.

Please read and reply with any questions or feedback you have.

–
Annabelle Richard Backman
AWS Identity

---

From: Roberto Polli <[email-masked]>
Date: Fri, 13 Dec 2019 10:15:17 +0100

Hi Annabelle,

> I have just published a new I-D on an old topic, HTTP Message Signatures: https://datatracker.ietf.org/doc/draft-richanna-http-message-signatures/
Is there a markdown version? If not I can create one.

To ease comments, here you can find an openly commentable google doc:

-  https://docs.google.com/document/d/1QgSDeWgU-cdFpKI6FiPvGhq6zgdhVE1ZVRcAQZ6AzPE/edit

I'm just starting now to add comments.

Thanks and regards,
R.

-- 
Roberto Polli
Full Stack Developer
M. +39 3406522736
·D
TEAM PER LA
TRASFORMAZIONE
DIGITALE
Presidenza del Consiglio dei Ministri
teamdigitale.governo.it

Il Team per la Trasformazione Digitale, salvo eccezioni, comunica con
le altre Amministrazioni via posta elettronica ordinaria e non posta
elettronica certificata, in conformità a quanto previsto dall’art.47
del Codice dell’Amministrazione Digitale.

---

From: Thomas Peterson <[email-masked]>
Date: Fri, 13 Dec 2019 10:55:14 +0000

Thank you for submitting this draft Annabelle.

Would it be possible to use your Github repository[0] for submitting 
issues or pull requests? If so, could you update the repository as it 
appears it differs from your submission.

Regards

0: https://github.com/richanna/request-signing

---

From: "Richard Backman, Annabelle" <[email-masked]>
Date: Fri, 13 Dec 2019 15:01:41 +0000

The latest changes are now available in the master branch, also under the tag draft-richanna-http-message-signatures-00. XML, TXT, and HTML versions of the draft are committed. My usual preference is to discuss things on list, but feel free to open issues or PRs if that's easier. I'm assuming that if adopted this document would move to one of the working group's repos though, so I don't think we should invest too much effort in its current home (hence why the topics for discussion are in the doc, not in issues themselves). Feel free to correct me if my understanding of HTTP WG process is incorrect.

Regarding a markdown version, my experience with kramdown-rfc2629 is that it does not support all the features I've needed when writing RFCs. Is this what the HTTP WG has been using , or is there a different toolchain I should look at? I'd prefer to work directly with xml2rfc v3, but I can do the conversion if that's how the working group operates.

– 

On 12/13/19, 5:55 AM, "Thomas Peterson" <[email-masked]> wrote:

    
    Regards

---

From: Thomas Peterson <[email-masked]>
Date: Fri, 13 Dec 2019 15:21:46 +0000

Thank you for updating the repository.

You're correct - working group documents have their own repository[0] 
and if the WG adopts your document, it too will move there. Those 
documents primarily use kramdown (in addition to Martin Thomson's 
toolchain[1] which I warmly recommend) so to ease future effort you may 
want to consider converting your document. Which particular features 
does kramdown not support that you need?

Regards

0: https://github.com/httpwg/http-extensions
1: https://github.com/martinthomson/i-d-template

---

From: Carsten Bormann <[email-masked]>
Date: Fri, 13 Dec 2019 16:29:29 +0100

On Dec 13, 2019, at 16:01, Richard Backman, Annabelle <[email-masked]> wrote:
> 
> 
> Regarding a markdown version, my experience with kramdown-rfc2629 is that it does not support all the features I've needed when writing RFCs.

Please tell us more about where kramdown-rfc is lacking.

There is a mailing list for writing RFCs in markdown:

https://www.ietf.org/mailman/listinfo/rfc-markdown

But you can also just drop me a note, if you prefer that.

Grüße, Carsten

---

From: Rob Sayre <[email-masked]>
Date: Sun, 15 Dec 2019 13:12:11 -0800

On Thu, Dec 12, 2019 at 4:22 PM Richard Backman, Annabelle <
[email-masked]> wrote:

> I have just published a new I-D on an old topic, HTTP Message Signatures:
> https://datatracker.ietf.org/doc/draft-richanna-http-message-signatures/
>
>
> This document describes a mechanism for creating, encoding, and verifying
> digital signatures or message authentication codes over content within an
> HTTP message. This mechanism supports use cases where the full HTTP message
> may not be known to the signer, and where the message may be transformed
> (e.g., by intermediaries) before reaching the verifier.
>
>
> There is growing widespread interest in this topic (see Justin Richer’s
> SecDispatch presentation at IETF 106); the goal of this draft is to provide
> a general purpose signing mechanism that can be used directly or profiled
> to fit specific use cases.
>

Hi,

Thanks for writing this up. I'd like Appendix B to compare and contrast the
draft with AWSv4, which seems to be good enough for many use cases.

In particular, I've noticed that mobile clients tend to segment uploads so
they can be resumed, and servers segment streaming media so they can switch
quality settings using things like HLS and DASH.

thanks,
Rob

---

From: "Richard Backman, Annabelle" <[email-masked]>
Date: Mon, 16 Dec 2019 19:30:01 +0000

It's been some time since I used it (the version installed on my laptop is 1.2.3...), but from what I recall I had trouble getting definition lists and (un)ordered lists to format the way I wanted. I readily admit this may have simply been a lack of knowledge on my part. I'll try to convert this draft and let you know if I run into any difficulties.

– 

On 12/13/19, 7:30 AM, "Carsten Bormann" <[email-masked]> wrote:

    

    
    Grüße, Carsten

---

From: Roberto Polli <[email-masked]>
Date: Mon, 16 Dec 2019 22:10:20 +0100

Hi Annabelle,

Il lun 16 dic 2019, 20:33 Richard Backman, Annabelle <[email-masked]>
ha scritto:

> It's been some time since I used it (the version installed on my laptop is
> 1.2.3...), but from what I recall I had trouble getting definition lists
> and (un)ordered lists to format the way I wanted.

I had some difficulties to render some non trivial parts too. But managing
contributions and PRs on markdown is great.

If I find some time I'll provide a simple .MD

Feedback on comments set on gdoc are very welcome too.

Have a nice day,
R

---

From: Roberto Polli <[email-masked]>
Date: Tue, 17 Dec 2019 17:34:04 +0100

Hi @all,

Here's a preliminary markdown stub:

- https://github.com/richanna/request-signing/pull/2

I'm still adding some missing parts :)

HTH,
R.