Re: [Acme] Signing HTTP Messages

[Richard Barnes <[e-mail]>]

Hey Manu,

Thanks for reaching out.  Just so the context is clear, there's nothing in
ACME currently that uses an HTTP header to convey a signature structure.
It's all in the body.

The draft-cavage- document had been pointed out to me before.  It's too
ambitious :)  That draft tries to solve the problem of signing an HTTP
message.  That's a fiendishly difficult problem because it involves
headers, whose complicated, ambiguous syntax is inimical to signing.  Also,
middleboxes routinely tamper with headers.

All I want is to sign the body of the message.  HTTP treats the body as an
octet string, which means there's no c14n issues.  And middleboxes tamper
with bodies much less often.

Also, the draft-cavage- document invents its own signature syntax, when it
should just use JWS.

So my proposal was: Start with a Content-Signature header that just has a
JWS covering the body.  In some cases that's all you want, and it's a more
tractable problem than covering HTTP messages as a whole.  Then, if you
want to protect HTTP headers later, you can add a signed attribute to the
JWS (e.g., digest(canonicalized-header-info)).

Does that make sense?   Is that at all relevant to your use cases?

--Richard




On Fri, Dec 19, 2014 at 6:00 PM, Manu Sporny <[e-mail]>
wrote:
>
> > I like the idea of using a header like container for the signature.
> > It makes good architectural sense and it is easy to code. A signature
> > is logically meta-data and so it should be expressed as a header.
>
> Hey Phillip, Richard,
>
> I'm not on the ACME mailing list, nor do I have the bandwidth to follow
> the ACME discussions (even though I love what you guys are doing over
> there) but what you two are talking about here:
>
> http://www.ietf.org/mail-archive/web/acme/current/msg00125.html
>
> Sounds an awful lot like this (which has existed for years):
>
> http://tools.ietf.org/html/draft-cavage-http-signatures-03
>
> I might be missing something, but saw your conversation fly by and
> thought I'd mention it.
>
> -- manu
>
> --
> Manu Sporny (skype: msporny, twitter: manusporny, G+: +Manu Sporny)
> Founder/CEO - Digital Bazaar, Inc.
> blog: High-Stakes Credentials and Web Login
> http://manu.sporny.org/2014/identity-credentials/
>