Re: Petition advocating mandatory RFC 9421 adoption for signing user data

I agree with Lucas — any regulatory or compliance requirement would need to be of a profile of 9421/9530 together. FAPI creates one such profile but this would need a lot more than that to be usable and testable by the bodies in question. You could require the regulators to create such a profile, but that is probably better left to a body more easily able to adapt to changes in technology. I don’t think it needs to be a prerequisite exactly, but it is a separate concern. That profile has to answer a lot of questions, especially those laid out in section 1.4 of 9421:

For example, how is key lookup performed in these cases? Do the keys need to be published on the origin somehow, and a lookup format/mechanism specified? Otherwise I can just claim that I signed something but the actual signature can’t be verified in any meaningful way.

 — Justin

On Jun 26, 2025, at 4:06 PM, Lucas Pardue <lucas@lucaspardue.com> wrote:

Hi,

The petition includes the text:

> RFC 9421 is a protocol that ensures electronic responses, especially those containing personal data, are signed with a digital signature. This protocol not only verifies the source of the data but also secures its integrity during transmission.

This seems to ignore the requirements in RFC 9421 section 1.4 [1], with respect to how to apply HTTP Message Signatures.

It's also ambiguous what integrity is referring to. Perhaps section 7.2.8, Message content is not covered by HTTP Signatures. Although there are examples of how to use RFC 9530 for this capability, it is not a normative requirement of RFC 9421. And again, application of HTTP Signatures depends on section 1.4.

All that is to say, a profile or application mapping of these technologies to solve the problem is the prerequisite to efforts like this.

Cheers
Lucas

[1] - https://datatracker.ietf.org/doc/html/rfc9421#section-1.4


On Thu, Jun 12, 2025, at 12:50, Kirill Kutsenok wrote:
Hello HTTP WG,

I would like to share a petition advocating for broader adoption and, where applicable, regulatory enforcement of RFC 9421<https://www.rfc-editor.org/rfc/rfc9421.html>, which defines HTTP Message Signatures:
https://www.change.org/p/mandate-rfc-9421-for-signing-digital-responses-containing-user-data

The motivation behind this effort is the increasing reliance on digital documents (such as bank statements or activity records) that users retrieve from websites and later present to third parties. Without a standard mechanism to authenticate these documents, their integrity and origin are often difficult to verify. RFC 9421 offers a potential solution by enabling digital signatures on HTTP responses, allowing recipients to validate the source and contents of the data.

The petition specifically calls for policymakers, regulators, and platform providers to consider mandating support for this mechanism in contexts where users are expected to share digital records with third parties. While widespread voluntary adoption would be beneficial, regulatory endorsement could provide a clearer trust model for consumers and relying parties.

While this initiative is not affiliated with the IETF, I thought it relevant to share with the working group given the technical overlap. Feedback is welcome, especially regarding real-world deployment considerations or known challenges with adoption.

Thanks for your time.

—
Kirill Kutsenok
Cryptography Researcher, Reclaim Protocol (https://reclaimprotocol.org<https://reclaimprotocol.org/>)