Interop for HTTP Signature Auth
David Schinazi <dschinazi.ietf@gmail.com> Wed, 24 January 2024 00:56 UTC
Return-Path: <ietf-http-wg-request+bounce-httpbisa-archive-bis2juki=ietf.org@listhub.w3.org>
X-Original-To: ietfarch-httpbisa-archive-bis2Juki@ietfa.amsl.com
Delivered-To: ietfarch-httpbisa-archive-bis2Juki@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BA86BC14F6FC for <ietfarch-httpbisa-archive-bis2Juki@ietfa.amsl.com>; Tue, 23 Jan 2024 16:56:44 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.754
X-Spam-Level:
X-Spam-Status: No, score=-2.754 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.249, HTML_MESSAGE=0.001, MAILING_LIST_MULTI=-1, RCVD_IN_MSPIKE_H5=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001, URIBL_DBL_BLOCKED_OPENDNS=0.001, URIBL_ZEN_BLOCKED_OPENDNS=0.001, WEIRD_PORT=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com
Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wWnyhQJqqsZT for <ietfarch-httpbisa-archive-bis2Juki@ietfa.amsl.com>; Tue, 23 Jan 2024 16:56:40 -0800 (PST)
Received: from lyra.w3.org (lyra.w3.org [128.30.52.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange ECDHE (P-256) server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DAC73C14F69B for <httpbisa-archive-bis2Juki@ietf.org>; Tue, 23 Jan 2024 16:56:39 -0800 (PST)
Received: from lists by lyra.w3.org with local (Exim 4.94.2) (envelope-from <ietf-http-wg-request@listhub.w3.org>) id 1rSRZ6-005Rd2-Nk for ietf-http-wg-dist@listhub.w3.org; Wed, 24 Jan 2024 00:56:28 +0000
Resent-Date: Wed, 24 Jan 2024 00:56:28 +0000
Resent-Message-Id: <E1rSRZ6-005Rd2-Nk@lyra.w3.org>
Received: from titan.w3.org ([128.30.52.76]) by lyra.w3.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from <dschinazi.ietf@gmail.com>) id 1rSRZ5-005Rc1-7v for ietf-http-wg@listhub.w3.org; Wed, 24 Jan 2024 00:56:27 +0000
Received: from mail-lj1-x234.google.com ([2a00:1450:4864:20::234]) by titan.w3.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (Exim 4.94.2) (envelope-from <dschinazi.ietf@gmail.com>) id 1rSRZ2-008Ifv-SV for ietf-http-wg@w3.org; Wed, 24 Jan 2024 00:56:26 +0000
Received: by mail-lj1-x234.google.com with SMTP id 38308e7fff4ca-2cf1b770833so7965751fa.0 for <ietf-http-wg@w3.org>; Tue, 23 Jan 2024 16:56:24 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1706057780; x=1706662580; darn=w3.org; h=cc:to:subject:message-id:date:from:mime-version:from:to:cc:subject :date:message-id:reply-to; bh=1aImFNtf3l9p7APf58J+8mVjp5+h73i4dvl9X1IeUG4=; b=Mc5N4U2wn+JF8Mu60mzcoV/8TPVSb5E+HK3SRxJC2Uj2FKaWP+acPsqKjG6rKXwK81 8KIAEplJdTktbV43Ym1rT2cUaINJLxTJa+o1Gi+EJKF/U3UBlLi4sfmu2ND53S2NrR3v ICd9d7iMHi0m5jMXGMkMsJhVAejzE155qHHSOMPM9o8eyffdtP/pc8SfeajsLFGLW8Tp AFEZu7MfzHPVgZfYwas7X2/dvCr0LgTEB3jYO/LRRnnvYwj5dqL2IFJtFvDHWVTKz4Rq dQ0u8AF4+qKbv/3Dc4ESBllhud5hwpwuPkI4D7BJLm1VPEuDXAo7D2/uz+Zbb6bGCqLa 1rLQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1706057780; x=1706662580; h=cc:to:subject:message-id:date:from:mime-version:x-gm-message-state :from:to:cc:subject:date:message-id:reply-to; bh=1aImFNtf3l9p7APf58J+8mVjp5+h73i4dvl9X1IeUG4=; b=sNEg84eF7VSAt2tdX0iAvIgfTI+0LRwaMgmsEttJXn3vNTE8k4w5NEUUJJOUJpuaeF Oz9k4u82DhYHUzlZbITGxocHy3v5xPUYmLt/gl9TFwSiD5UeycI9cFznNWwNBTePawzm nFw6NWUONB8bstBJXWL/mggqXUDLBLpeuiyIzdms80XQ/xgmcS8ayhekysxGYOwC9YGW f+OGjSTROepQ4NeIlS1wjVzMMa3fN1TUW89G0QWqkZe5jZ8OROoiwIPVZI+NoIcxfMnK X4SppC7aC63q7TMzs+AsUWq5ZjbgVyFIVrB+6Fq4ZEuScD0L0PDnSndkUlRrxyCXk2FB mH2A==
X-Gm-Message-State: AOJu0YwNvDJlSDWnLd53GWzYmqnXRhkuOvQBJ12OwTfRQZGYbLX5E3hJ P9MdBN3FVpYgXZrxxKB2gY3cf3VmXBrl/CiGxuA7n8LbBDSuC/UuEZdgozMHSFq9Ns3u/ff5RAP kcxf9d25Z24pWwzNlyzELFIEUf1oc2nnaLmI=
X-Google-Smtp-Source: AGHT+IHvoFTnmajGjkqfr7kE0KB7b396lP4MVprmIV9ivhEYhzvHngGB20KZBDHnAyh6qrkkh8dFqnhOMdi80IHKnJU=
X-Received: by 2002:a05:6512:398c:b0:50e:7bdf:f123 with SMTP id j12-20020a056512398c00b0050e7bdff123mr3668210lfu.135.1706057779816; Tue, 23 Jan 2024 16:56:19 -0800 (PST)
MIME-Version: 1.0
From: David Schinazi <dschinazi.ietf@gmail.com>
Date: Tue, 23 Jan 2024 16:56:08 -0800
Message-ID: <CAPDSy+6+GEKYmd6WqCeJfeSvMJkf9CnXidmo2XMY2NYKcz1+-w@mail.gmail.com>
To: HTTP Working Group <ietf-http-wg@w3.org>
Cc: François Michel <francois.michel@uclouvain.be>, Jonathan Hoyland <jonathan.hoyland@gmail.com>, David Oliver <david@guardianproject.info>
Content-Type: multipart/alternative; boundary="000000000000eeaba0060fa68750"
Received-SPF: pass client-ip=2a00:1450:4864:20::234; envelope-from=dschinazi.ietf@gmail.com; helo=mail-lj1-x234.google.com
X-W3C-Hub-DKIM-Status: validation passed: (address=dschinazi.ietf@gmail.com domain=gmail.com), signature is good
X-W3C-Hub-Spam-Status: No, score=-6.1
X-W3C-Hub-Spam-Report: BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, W3C_AA=-1, W3C_DB=-1, W3C_IRA=-1, W3C_WL=-1, WEIRD_PORT=0.001
X-W3C-Scan-Sig: titan.w3.org 1rSRZ2-008Ifv-SV ae58a176aeda96c6d7bd2e3ceff346f3
X-Original-To: ietf-http-wg@w3.org
Subject: Interop for HTTP Signature Auth
Archived-At: <https://www.w3.org/mid/CAPDSy+6+GEKYmd6WqCeJfeSvMJkf9CnXidmo2XMY2NYKcz1+-w@mail.gmail.com>
Resent-From: ietf-http-wg@w3.org
X-Mailing-List: <ietf-http-wg@w3.org> archive/latest/51730
X-Loop: ietf-http-wg@w3.org
Resent-Sender: ietf-http-wg-request@w3.org
Precedence: list
List-Id: <ietf-http-wg.w3.org>
List-Help: <https://www.w3.org/email/>
List-Post: <mailto:ietf-http-wg@w3.org>
List-Unsubscribe: <mailto:ietf-http-wg-request@w3.org?subject=unsubscribe>
Hi HTTP enthusiasts, I'm happy to report that today we accomplished bidirectional interop between two independent implementations of HTTP Signature Auth, Google QUICHE in C++ [1] and François's in Go [2]. Both have publicly accessible servers: François has one that accepts any public key [3] and then we both have ones that you'll need to send us public keys for [4, 5]. I suggest trying François's server first, it displays better debug information than mine :-) This also helped us make minor editorial fixes to the document, which we've shipped as -06 [6]. My sincere thanks to François for working on this. We look forward to working with anyone else interested in interop here. Cheers, David [1] https://github.com/google/quiche [2] https://github.com/francoismichel/http-signature-auth-go [3] https://httpsignature.francoismichel.be/signature/insecure/draft-ietf-httpbis-unprompted-auth-05 [4] https://httpsignature.francoismichel.be/signature/draft-ietf-httpbis-unprompted-auth-05 [5] https://masque.uno:4321/ [6] https://www.ietf.org/archive/id/draft-ietf-httpbis-unprompted-auth-06.html
- Interop for HTTP Signature Auth David Schinazi
- Re: Interop for HTTP Signature Auth Andrew Jones