IETF Logo Mail Archive

[OAUTH-WG] HTTP Message Signatures

Justin Richer <jricher@mit.edu> Tue, 28 July 2026 17:53 UTC

Return-Path: <jricher@mit.edu>
X-Original-To: oauth@mail2.ietf.org
Delivered-To: oauth@mail2.ietf.org
Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id 9671D11FF87AE for <oauth@mail2.ietf.org>; Tue, 28 Jul 2026 10:53:58 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1785261238; bh=ayGxB+mk20qYbi39j9hRHiSkyiaTHYnwJC5F4yv/h9k=; h=From:To:Subject:Date; b=HUN+C6ZF00KUfYX4c7pGGQTMiTbcJBm3lL2CjrOwk78LD+LBjAtd/EC0YpZmFOGDg DuyAXc16eFOHzERVi5EktFY+aE6ebtZEO/631dg+UV6dFhVMUWozBpyI+BkmjtIy28 W1yvxrNtU/PygtSflmMR0NH/D+aE9r5dDfS4+eoU=
X-Virus-Scanned: amavisd-new at ietf.org
X-Spam-Flag: NO
X-Spam-Score: -2.095
X-Spam-Level:
X-Spam-Status: No, score=-2.095 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=0.001, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no
Authentication-Results: mail2.ietf.org (amavisd-new); dkim=pass (1024-bit key) header.d=mit.edu
Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rNdmL8BrlQ-s for <oauth@mail2.ietf.org>; Tue, 28 Jul 2026 10:53:58 -0700 (PDT)
Received: from CH5PR02CU005.outbound.protection.outlook.com (mail-northcentralusazon11022110.outbound.protection.outlook.com [40.107.200.110]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange ECDHE (P-384) server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id E1F4411FF87A7 for <oauth@ietf.org>; Tue, 28 Jul 2026 10:53:57 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=oiAV1eTHK/32v6hluwWJC9v7ZZX8SMDzOei7IWM9dbUXTUgsvB0KG2xoll5zGd2pOHTF8nxth5zImOqrZ6Jt24S3ZHUmNyUAwI5yHMZY7/hPtfJyupyGMmgso9PkhTcvlaRY3j+DF3vYB9X7PeYefiXaftI8L8CxobnbOvyqYE3L0LF8eKkRxpOeYBQQAIl8C5bGtZxWtIoxbbObrzNjAIN2K9Lgo5nhlRBNPZKvhlRLQkjj1aBuUpntvc2cD95fZWX6uLFF4u1d3jhNgz3OonxKNTS8xvzPwP4aikpunuouUn7k4dpl6AgDn92PEhraSpV+S/F3Rnug4Ktu+ECrHA==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=/K9kmr2FMZ4Ngp79Fi/1aJFjcw8Lp6vUb+iN0sI6dFE=; b=iQCOvlNzLeHxiGtt/HILvZBV7x185ECkxsXqp0ySbHJ2Siil3swRX1yKXEO81vxGEFu3BpJN62q7G/PE0yJL5LCES55wAnOKrv996LmxKWHMDPq7c/TwoOOK8NPsWhc5cUAuw+PHckqSR+V9PSr3WWTwkc+46LblgD8r75LUTUlvwL1RpExzR18gaUm4t3x134M/Cu8S1q7X2RLnMfcWFEXoDpCWwqLA5pg5X5PrMtiDaDfG0EqpOobiN/ciVysWE8K4QTSWSF4BmaKAM9iydXlFgcI7LQKlPDo2iDXq6TQxZMt5Xb48+oQsmm+3clN/PX9fQZo6Zrw/z+kmVF6heg==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=mit.edu; dmarc=pass action=none header.from=mit.edu; dkim=pass header.d=mit.edu; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mit.edu; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=/K9kmr2FMZ4Ngp79Fi/1aJFjcw8Lp6vUb+iN0sI6dFE=; b=NYJ5hGHt9y+yMb51EdWY/ZiGOUmHs6UDJbW7n1JfM/RYveqKShog4uUa++Vy5BxZQF8BRAVCArSyhUrXZyaGYZkC4w3KxKEAHk/Bkkq1ozaCR9yS6/eFXLcQ35QZlIO7lT1BMRpOjWd3F1WrNHLNZSPJh11wX2V8955c19Vg1fc=
Received: from CH3PR01MB8285.prod.exchangelabs.com (2603:10b6:610:17c::19) by SA0PR01MB6426.prod.exchangelabs.com (2603:10b6:806:e8::22) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.223.18; Tue, 28 Jul 2026 17:53:49 +0000
Received: from CH3PR01MB8285.prod.exchangelabs.com ([fe80::2225:4c51:4e87:a105]) by CH3PR01MB8285.prod.exchangelabs.com ([fe80::2225:4c51:4e87:a105%7]) with mapi id 15.21.0270.009; Tue, 28 Jul 2026 17:53:49 +0000
From: Justin Richer <jricher@mit.edu>
To: oauth <oauth@ietf.org>
Thread-Topic: HTTP Message Signatures
Thread-Index: AQHdHrlxPHz/aV+tAUS/XxY461pjKg==
Date: Tue, 28 Jul 2026 17:53:49 +0000
Message-ID: <CH3PR01MB82855BD9FAF0C69812B18C6ABDCB2@CH3PR01MB8285.prod.exchangelabs.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
msip_labels:
authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=mit.edu;
x-ms-publictraffictype: Email
x-ms-traffictypediagnostic: CH3PR01MB8285:EE_|SA0PR01MB6426:EE_
x-ms-office365-filtering-correlation-id: fcf6fb76-7030-4048-666d-08deecd12dd8
x-ms-exchange-senderadcheck: 1
x-ms-exchange-antispam-relay: 0
x-microsoft-antispam: BCL:0;ARA:13230040|376014|786006|23010399003|366016|1800799024|38070700021|13003099007|6133799003|56012099006|10067099003|11063799006|18002099003|8096899003;
x-microsoft-antispam-message-info: C+LgJbZuP5Qk4ZhGDNXGirrNcLvHl/He8JVRWaLQkUiFmtT2WBEgAHnos5kARJzHSntmN3yDl6E6FRRNnWZZXomW2nQQ72fL47aX+hqyFwhizt9ztAjsCzwk9uYk/vaHzXYtZVNpnvdfHkIQDDpcei30BRems6ooMcsHT9WWvEv5ZAyq+9TAG1PWtt8u/jQ9AuuQOLzsALhreP09TlXgWyuASC/B8f8rwIbxubqc6SC/vuEUCF/dz5ipaQYzdDD5/Y9MySXeaqwsTVgTnlOwaF8Op3Efp+SVtbuOM/aBeCdBsuoe64V36SQR+buYhJs16KdY3Kh1OgCt9BNZztSB7gCfZTsRwQmd66AY+p/yWj6uNBY444ezH3asN7YGtLbf+44Rqvn6Ba+p8CRbfTcc19zHhL2kT4SWuRis9a2X13sXMokeqWbx9vhXAvGmTnSY+cYceZvmHPHyqw8E9+K1si+QtX8EFQrkJ1OhDfW4v+X9UT20ZawWAGZBpHOGou+mcToiRp2avqZH3XdBSYoruVhUYmSXBjIbkqFDeKskuwp9IRnEaORpeUxOoodhaa4pFjEZPFVVlT8yjySrI50IYOjDeIqNxjtmNOZCUDzh5CjeFhqoIst2b0QvPATnhoG1qhCMK5Un/TyMarUta6bbJ0OJAYJv15HqXwyOApsY1uSIBThWwAjN15MApBCDEW/QYZbKDKKyZxQnrthrf6GEvYNCGzAa4t0qDcUVb7dv09E=
x-forefront-antispam-report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:CH3PR01MB8285.prod.exchangelabs.com;PTR:;CAT:NONE;SFS:(13230040)(376014)(786006)(23010399003)(366016)(1800799024)(38070700021)(13003099007)(6133799003)(56012099006)(10067099003)(11063799006)(18002099003)(8096899003);DIR:OUT;SFP:1102;
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: N+C/YMcM6tvhF3MLhHy/Y4cVfW3efF2NLt7RcIDym8Ziccgj+YSnnBur1wy/KK5TGxY3o4LxpBhk3AX9VkgLjOh0HA/QEvNpCcS+AoDSiNXnjRSB4VzJVaG3KFWLeuXTkJSdbH26EVVFR6dZ4i7iwkmlPX1cPM0C7laVFppK5Ci3FRq4EGsYGCGULA1Iiy2pArkRBJW5jT6o4FJClTuHYmJse/L4S9kx8DcN1nIw/ofK8uS1cMUHB5c30LYfv7dFjRVa3E3ct4H5xS4K8mVlXThIYfWMl/9hqCe+Nhdgo6XAGtXXI4zLCIkoyZfnLrOSpb5HY6P547l7wiLajbU8Tq9Y1foiHmRkiWAPNpgg3GjPWlgwh08pGlrvH2L1X0bZfLQm+kN/V1wlDIY4eqLTVlQdL+F+tuL0kTJYdopekEnStkOx4/ABnfNXD9RdKlZ3MymOIO593QnpZzTJXWcGeS0MPUPLlytocXB7q9WFF1pvwtIVapV00a9DTH7V+3WZtZ7dxxqLTmvu997TlE945mOB80ZQekPXB5Czv/dgXToeEiB289KNoarP4CkUeA2nubzzKtfl4VrrWKBabJf+qSEzTMntt/rhXMTrt+pB13jXV6Tnq21hi2FltIm299gZ78dqCo/EbnE1Ohq9kvvW+KZyOcBB8ns5gBkUKYAgVj6LVKAg5uvGAWMYJ9wgdavLIxMN4HUmbKSX/UqBTn+ZLYKJexPQjJtzg2FS5m1XxzwtfcXRt3ri3yKaIBJR/QpiBgUU9NtLVWSMOGgQe7Ej4lIXsBPww88FGkC0W8A06+vTolebGVFw1JGYF/bpsE4rjQTxSoci9yLlfz3QxbD7r7lbh+Gf4vwLpWME5SaO2IgdYNVIch5oz3ZpZbYFskE49BGhmSe4jn9/36QLvYOJiHLKzNoPPWuYhs9pxdO3XXWsnINIc3jHsxq5vGbw0AobiW2Usacs+lL0SsaLuiCoE2YmiipWD889TXdEzFjxIJaq5N1neOPsZIVSv7nsqcNr34Nd5sItMlGtffNL8BwZL7eCV5ttyi1GI3yzr+tBqZc6khqk/HMLpU6aWBUSshuveFP2ghbrjuzXc4c/2Io6syIav1Bpw4EKnWQpAS5HlKfTdq8a2cgzUogrfHRRoQLrI8VOGgu4FjbHgA/xtRbSXkhQLXdzZ+4Bjr6P9TKkVwLmni08AIt7sCEgEdzT3bZpQHvzTtQU2efOkOIt1rxlyRx6qE0C92Tu5A5i7ZFURIQZEOfUeDTFVSJc7ALPCyEW4+hq9DC8n5Qi0mGVbfU305kjcuCwB1AJVWGbEnS9VedVr8fl8Q7zhGcgDEVDQFnTtFYWk3N1+n3BisdQwmelPF9JLinMS/nf2DwHEBOC9rFQa2+dIAAnwi7nK1GLDRDn0B0NL6oxtgk3lfFDf0jnVe4rOZo/jk73eRp+xRo8YMSB3NPHr4K/drTzWTUNWGFR665bxxqQmZz352VzQK2fCwJsJavfzXwbTJYnhQKe3XXjiYhMP1A6LbGtbFZJI76ty61A0AJfj9bZIGSg/TCgpe/Lc3b6sPWU4Q9VewoUQ1p+iybMTacXr16IgyIzT5jOwSTVCN12SRlQVOfrsBxX78ael77ctKqvjcb/2VqPOBs2bk6gSdekNYcE5xOYCQyLwE8aR2nkcfQYVHW7P0ReQaNhfZcWW4/Pk0qtUepgiKY=
Content-Type: multipart/alternative; boundary="_000_CH3PR01MB82855BD9FAF0C69812B18C6ABDCB2CH3PR01MB8285prod_"
MIME-Version: 1.0
X-OriginatorOrg: mit.edu
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: CH3PR01MB8285.prod.exchangelabs.com
X-MS-Exchange-CrossTenant-Network-Message-Id: fcf6fb76-7030-4048-666d-08deecd12dd8
X-MS-Exchange-CrossTenant-originalarrivaltime: 28 Jul 2026 17:53:49.0740 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 64afd9ba-0ecf-4acf-bc36-935f6235ba8b
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: tT8Tc0wqDGMq2V0i7DmmuFOpT1Jx1/1cWnTzbNT+9ZApD/wrNTEVBkbH9WDiN7/I
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SA0PR01MB6426
Message-ID-Hash: 6TFBO3CTQUDUN7YFCLDSLVZV75S5QRVD
X-Message-ID-Hash: 6TFBO3CTQUDUN7YFCLDSLVZV75S5QRVD
X-MailFrom: jricher@mit.edu
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-oauth.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [OAUTH-WG] HTTP Message Signatures
List-Id: OAUTH WG <oauth.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/oauth/RmiyerTjgYwWnwcDV_2SGKZehYg>
List-Archive: <https://mailarchive.ietf.org/arch/browse/oauth>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Owner: <mailto:oauth-owner@ietf.org>
List-Post: <mailto:oauth@ietf.org>
List-Subscribe: <mailto:oauth-join@ietf.org>
List-Unsubscribe: <mailto:oauth-leave@ietf.org>

After the meeting last Friday, a bunch of us joined up to work on the HTTP Message Signatures draft — huge thanks to Paul, Christian, and Filip for joining me and Aaron.

Name:     draft-richer-oauth-httpsig
Revision: 03
Title:    OAuth Proof of Possession Tokens with HTTP Message Signatures
Date:     2026-07-28
Group:    Individual Submission
Pages:    23
URL:      https://www.ietf.org/archive/id/draft-richer-oauth-httpsig-03.txt
Status:   https://datatracker.ietf.org/doc/draft-richer-oauth-httpsig/
HTML:     https://www.ietf.org/archive/id/draft-richer-oauth-httpsig-03.html
HTMLized: https://datatracker.ietf.org/doc/html/draft-richer-oauth-httpsig
Diff:     https://author-tools.ietf.org/iddiff?url2=draft-richer-oauth-httpsig-03

This new version changes how we present inline public keys, and adds the first step of considerations for RS-side validation of bound tokens.

Please read through this when you can, and implement it if you can, and give us your comments on here or on GitHub. We've asked the chairs to schedule and interim to discuss this work and we'd like to bring this forward for adoption modulo the interim discussion.


  *
Justin

v2.46.0 | Report a Bug | By Email | System Status