- From: Backman, Annabelle <richanna@amazon.com>
- Date: Wed, 15 Mar 2023 11:59:12 +0000
- To: Martin Thomson <mt@lowentropy.net>
- CC: "ietf-http-wg@w3.org" <ietf-http-wg@w3.org>
I agree; we can amend it to explicitly state what this spec does and does not do. This could be reiterated in section 1.4, Application of HTTP Message Signatures. — Annabelle Backman (she/her) > On Mar 14, 2023, at 10:11 PM, Martin Thomson <mt@lowentropy.net> wrote: > > CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you can confirm the sender and know the content is safe. > > > >> On Wed, Mar 15, 2023, at 05:46, Backman, Annabelle wrote: >> Note that like HTTP Message Signatures, SigV4 is not a complete >> security protocol. > > I think that this is an important point that is likely lost on readers of this document. One that can be fixed, I think, relatively easily. > > The framing in the draft pretty much cleaves along the lines of stating that this is a solution, take the introductory sentence from Section 1.4: > >> HTTP Message Signatures are designed to be a general-purpose security mechanism applicable in a wide variety of circumstances and applications. In order to ... > > A more direct acknowledgment of this limitation might head off the sorts of objections Harald raises. Perhaps something like: > >> HTTP Message Signatures describe a mechanism for signing selected portions of HTTP messages. This is not intended to be a complete security mechanism; rather, HTTP Message Signatures form a component in a larger system that depends on authenticating messages. In particular, the choice of which portions of messages are signed will determine what properties might be obtained. In order to ... >
Received on Wednesday, 15 March 2023 11:59:27 UTC