[Txauth] HTTP Signing Draft in HTTP WG

Justin Richer <jricher@mit.edu> Mon, 20 January 2020 16:55 UTC

From: Justin Richer <jricher@mit.edu>
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\))
Message-Id: <DEF20912-A66E-4FB7-B6DB-CF83CC86F9FE@mit.edu>
Date: Mon, 20 Jan 2020 11:55:12 -0500
To: txauth@ietf.org
Archived-At: <https://mailarchive.ietf.org/arch/msg/txauth/5K8xS4l1Km1jY6uEAZ1vqEM6KGw>
Subject: [Txauth] HTTP Signing Draft in HTTP WG
Precedence: list

As many of you know, Annabelle and I have put forward a general-purpose HTTP Signing specification in the HTTP Working Group, at least initially based on the old Cavage signatures spec that’s been used in the wild. We expect a number of important changes to happen as it goes through the standards process (which is to say, we aren’t approaching this to get a stamp on existing code), including some key things that would allow it to be used for one of TxAuth’s proof os possession mechanisms. In fact, I’ve implemented a version of the Cavage draft in the XYZ prototype alongside DPoP style signatures and my old OAuth HTTP Signing draft (which is now expired). 

I believe this work will be an important building block for TxAuth, alongside MTLS, JOSE, and other crypto systems. 

The new draft is currently going through its call for adoption within the HTTP WG, and if you have any interest in this work moving forward, please join the thread on the HTTP list to show your support for the draft. The Call For Adoption is currently open and runs through Jan 31.

Thanks,
 — Justin

[Txauth] HTTP Signing Draft in HTTP WG Justin Richer