[WIMSE] Re: I-D Action: draft-ietf-wimse-http-signature-05.txt

[Yaron Sheffer <[e-mail]>]

Hi Andrii,

I'm not sure I'm following. Both the WPT solution and the HTTP-Sig solution are end-to-end. So if there's information that an intermediary can legitimately strip away, then it CANNOT be covered by either mechanism. What am I missing?

Thanks,

    Yaron

On 21/07/2026 21:29, Andrii Deinega wrote:

Hi Yaron,

Have there been any discussions or maybe, even proposals within the WIMSE WG regarding passing additional information along with WITs, somewhat similar to the https://opentelemetry.io/docs/specs/otel/baggage/api/" rel="nofollow">OpenTelemetry (OTel) Baggage API and the https://www.w3.org/TR/baggage/" rel="nofollow">W3C Baggage specification?

Of course, I mean passing (additional) information in some standardized way that makes sense for workloads + makes sense when HTTP Signatures are in "use".

A few examples where it could be useful

1. Workload1 wants to share additional information to Workload2 (this info isn't included in its WIT)
2. Intermediary1 wants to strip some info from a call from Workload1 to Workload2 (say information about its instance that Workload2 doesn't need to see)
3. Intermediary2 wants to add some info from a call from Workload1 to Workload2

?

I recall some discussions took place in other WGs like "wouldn't it be great if we could attach some attribute to an issued AT and then be able to cryptographically validate that".

A combination of HTTP Signatures, SD (Selective Disclosures), a WIT + the private key associated with this WIT seems like allowing doing that in my eyes.

Thank you.

Best regards,
Andrii

On Mon, Jul 20, 2026 at 2:00 AM Yaron Sheffer <[e-mail]> wrote:

This version updates the sample signed messages, in line with the latest normative text.

Thanks,

    Joe and Yaron

On 20/07/2026 10:58, [e-mail] wrote:

Internet-Draft draft-ietf-wimse-http-signature-05.txt is now available. It is
a work item of the Workload Identity in Multi System Environments (WIMSE) WG
of the IETF.

   Title:   WIMSE Workload-to-Workload Authentication with HTTP Signatures
   Authors: Joe Salowey
            Yaron Sheffer
   Name:    draft-ietf-wimse-http-signature-05.txt
   Pages:   21
   Dates:   2026-07-20

Abstract:

   The WIMSE architecture defines authentication and authorization for
   software workloads in a variety of runtime environments, from the
   most basic ones to complex multi-service, multi-cloud, multi-tenant
   deployments.  This document defines one of the mechanisms to provide
   workload authentication, using HTTP Signatures.  While only
   applicable to HTTP traffic, the protocol provides end-to-end
   protection of requests (and optionally, responses), even when service
   traffic is not end-to-end encrypted, that is, when TLS proxies and
   load balancers are used.  Authentication is based on the Workload
   Identity Token (WIT).

The IETF datatracker status page for this Internet-Draft is:
https://datatracker.ietf.org/doc/draft-ietf-wimse-http-signature/" target="_blank" class="moz-txt-link-freetext" rel="nofollow">https://datatracker.ietf.org/doc/draft-ietf-wimse-http-signature/

There is also an HTML version available at:
https://www.ietf.org/archive/id/draft-ietf-wimse-http-signature-05.html" target="_blank" class="moz-txt-link-freetext" rel="nofollow">https://www.ietf.org/archive/id/draft-ietf-wimse-http-signature-05.html

A diff from the previous version is available at:
https://author-tools.ietf.org/iddiff?url2=draft-ietf-wimse-http-signature-05" target="_blank" class="moz-txt-link-freetext" rel="nofollow">https://author-tools.ietf.org/iddiff?url2=draft-ietf-wimse-http-signature-05

Internet-Drafts are also available by rsync at:
rsync.ietf.org::internet-drafts

--
WIMSE mailing list -- [e-mail]
To unsubscribe send an email to [e-mail]