[Web-bot-auth] Re: Signature Misbinding in httpsig-protocol-00

[Thibault Meunier <[e-mail]>]

On Wednesday, July 22nd, 2026 at 10:05, Dennis Jackson <ietf=[e-mail]> wrote:

> In 4.2.2 of draft-meunier-webbotauth-httpsig-protocol-00 [1], the draft
> proposes signing signatures:
> 
>  > A signer MAY cover selected members from another signature label,
>  > including "signature";key=..., "signature-input";key=..., and
>  > "signature-agent";key=.... This lets a signer preserve evidence that
>  > another signer contributed to the request.
> 
> I don't think this is correct.
> 
> RFC 9421 7.3.7 'Signing Signature Values' [2] recommends against what's
> described in the draft, because it doesn't bind the message that
> corresponds to the inner signature:
> 
>  > While it would seem that this practice would transitively cover the
>  > components under the original signature in a verifiable fashion, the
> attacks
>  > described in [JACKSON2019] can be used to impersonate a signature output
>  > value on an unrelated message.
> 
> If you only want to preserve evidence that a message was signed by
> another, you don't need to sign their signature, you just need to
> preserve their signature, message and public key, so removing this text
> and stating that verifiers should check each signature independently
> would work and avoid these footguns.
> 
> If you want a stronger property, like 'Party A only signed this message
> because Party B signed it first', that requires some more careful handling.

The goal is Party A only signed because Party B signed first. I'll check [JACKSON2019], but happy to get advice and pointers here. I'll also correct the text to avoid going against RFC 9421 7.3.7

> 
> Best,
> Dennis
> 
> [1]
> https://www.ietf.org/archive/id/draft-meunier-webbotauth-httpsig-protocol-00.html#name-multiple-signatures
> 
> [2]
> https://www.rfc-editor.org/rfc/rfc9421.html#name-signing-signature-values
> 
> 
> _______________________________________________
> Web-bot-auth mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
>