- From: Martin Thomson <mt@lowentropy.net>
- Date: Wed, 15 Mar 2023 09:07:19 +1100
- To: ietf-http-wg@w3.org
On Wed, Mar 15, 2023, at 05:46, Backman, Annabelle wrote: > Note that like HTTP Message Signatures, SigV4 is not a complete > security protocol. I think that this is an important point that is likely lost on readers of this document. One that can be fixed, I think, relatively easily. The framing in the draft pretty much cleaves along the lines of stating that this is a solution, take the introductory sentence from Section 1.4: > HTTP Message Signatures are designed to be a general-purpose security mechanism applicable in a wide variety of circumstances and applications. In order to ... A more direct acknowledgment of this limitation might head off the sorts of objections Harald raises. Perhaps something like: > HTTP Message Signatures describe a mechanism for signing selected portions of HTTP messages. This is not intended to be a complete security mechanism; rather, HTTP Message Signatures form a component in a larger system that depends on authenticating messages. In particular, the choice of which portions of messages are signed will determine what properties might be obtained. In order to ...
Received on Tuesday, 14 March 2023 22:07:53 UTC