Subject: HTTP Signatures Updates

From: Justin Richer <[email-masked]>
Date: Tue, 27 Apr 2021 12:55:31 -0400

The editors of the HTTP Message Signatures spec wanted to let the group know that with the recent publication of -04, we believe the major surgical changes from the input community drafts have been completed and it’s a newly stable base:

https://www.ietf.org/archive/id/draft-ietf-httpbis-message-signatures-04.html <https://www.ietf.org/archive/id/draft-ietf-httpbis-message-signatures-04.html>

The major changes revolve around adopting structured fields as the basis for both signature base string creation as well as signature header contents. With these, we now have a way to discuss things in terms of structures with well-defined serializations, which is vital for good security. This has let us do things like cover signature parameters and pave the way for multiple signatures in a single request. We’ve also changed out the perspective of the protocol from something that was solely focused on a header format to something that deals with signatures and signing algorithms more holistically. Specifically, where there once was a required “algorithm” parameter that defined actions, there are now a set of requirements for defining algorithm and key resolution with the parameter as one input. 

What does this mean? For one, we aren’t saying it’s done or that it’s perfect: there are still plenty of rough edges that need to be sanded, lots of language that isn’t quite fully accurate yet (headers vs fields, for instance), and I’m sure a few missing features. I’m sure we’ll still bike shed a few things and possibly tweak the syntax. But all that said, we don’t anticipate the kinds of major architectural changes. Now is the time for the working group to dig into it, try it out, figure out what the edges are, and define this more concretely.

So while we don’t think it’s ready for WGLC yet, we would like to get more eyes on the text and help keep pushing it forward. Please review the draft, help file issues (and/or PRs), and try to build the blasted thing. I’ve implemented the current draft myself on a couple platforms, and I’ve been seeing other implementers tracking it as well. It’s encouraging to see running code on this at this stage.

Thanks,
 — Justin

---

From: Henry Story <[email-masked]>
Date: Tue, 27 Apr 2021 21:43:45 +0200

> On 27. Apr 2021, at 18:55, Justin Richer <[email-masked]> wrote:
> 
> [...]

As Justin knows from the recent issues I submitted [1], I have been busy over the
past weeks writing an implementation of Signing HTTP Messages in Scala 3 :-).

This required me to implement RFC8941 from scratch and I am nearly done with signing
messages. Both have a good set of tests to go with them.

The code is in the repo here together with a web server I am writing and which I will be
testing it with
  https://github.com/co-operating-systems/Reactive-SoLiD

The code could easily be extracted into self contained libraries both for RFC8941 and
for Signing Messages, enabling it to work with multiple web frameworks, both in the Java and
JavaScript ecosystem,  since Scala compiles to both.

I have been able to do this due to a grant from the EU in a project called
Solid Control [2]. The project involves writing a web server as well as
authentication and authorization framework [3].

As I am getting paid my Milestones I had to make up before the project, and am a bit
late I am not going to have time to turn these into nice self contained libraries.
If anyone here would like to take that on, that would be great. As the milestones
are not strictly time limited, I could also be convinced to put some time into
doing that if there is a real need.

Henry

[1] It is worth checking these out, as there are a few important fixes on the way
    https://github.com/httpwg/http-extensions/issues/created_by/bblfish
[2] https://nlnet.nl/project/SolidControl/
[3] https://github.com/bblfish/authentication-panel/blob/HttpSig/proposals/HttpSignature.md

https://co-operating.systems
WhatsApp, Signal, Tel: +33 6 38 32 69 84‬
Twitter: @bblfish