- From: Jeffrey Yasskin <jyasskin@google.com>
- Date: Fri, 1 Sep 2017 10:18:01 -0700
- To: Lucas Pardue <Lucas.Pardue@bbc.co.uk>
- Cc: HTTP Working Group <ietf-http-wg@w3.org>
On Fri, Sep 1, 2017 at 10:04 AM, Lucas Pardue <Lucas.Pardue@bbc.co.uk> wrote: > Hi Jeffrey, > > I spotted this yesterday and found it an interesting read, so thanks for starting a discussion. > > Your draft references draft-cavage-http-signatures, which we have been using on a project to add some authenticity to HTTP/2 pushed content. I'm still processing your draft but can see how it might complement our approach or help satisfy the higher goal. > I'm glad to hear it. :) What kind of software winds up checking that authenticity? How do you transmit the public key? Do you need to revoke keys or prevent downgrade attacks? (I'd be happy to read a document about this, if you have one, rather than making you retype it on the mailing list.) Thanks, Jeffrey
Received on Friday, 1 September 2017 17:18:45 UTC