[GNAP] Signature Methods

[Justin Richer <[e-mail]>]

In GNAP, most requests are signed in some way, or at least bound to a key being presented or referenced with the request. This is true for connections from the client instance to the AS and to the RS, as well as introspection requests from the RS to the AS. GNAP has always sought to be flexible with regard to cryptographic binding mechanisms, but there’s a question as to what should remain defined in the core document. Right now, core has six methods defined. The editors are proposing that we keep at least two and drop two, and the others could either both be kept, both be dropped, or one kept. The rationale for each proposal is discussed below:

Proposed to keep:

- HTTP Method Signatures: general purpose mechanism, being defined in HTTP WG. Can be bound to symmetric and asymmetric keys. Usable for native, web, and SPA clients. Suggested MTI for the AS (but not mandatory to use) for interoperability. Side note, possible use for AS to sign responses (but not explored here yet — that’s another topic).

- Mutual TLS: based on OAuth MTLS, ties the keys at the TLS layer to the application protocol (GNAP). 


Proposed to drop:

- OAuth PoP: expired draft, due to be replaced with new draft based on HTTP Message Signatures.

- OAuth DPoP: only works for asymmetric keys, requires key be presented in the header (duplicating information from GNAP messages). It was never meant to be a general purpose signing mechanism, though the FAPI group in OIDF is considering it as an option in current proposed work. 


This leaves the two JWS based methods, detached and attached. Since attached JWS depends on the detached JWS method to handle body-less requests like GET, DELETE, OPTIONS, etc., if we remove the detached method then we have to remove both. The methods could be pulled to an extension, left in core, or removed entirely. 

The editors would appreciate feedback on this proposal, including specific feedback on the JWS methods from implementors who are targeting them.


 — Justin