Sameeh Jubran
|
9a3b8458b3
|
Add RFC 9421 HTTP Message Signatures example using wolfCrypt Ed25519
Initial implementation of RFC 9421 HTTP Message Signatures as a
wolfssl-examples project. Covers a minimal interoperable subset:
derived components (@method, @authority, @path, @query), arbitrary
HTTP header fields, Ed25519 signing/verification, single signature
(sig1), and timestamp-based replay protection.
Files:
- common/wc_sf.{c,h}: Minimal RFC 8941 structured fields subset
(dictionary lookup, inner lists, parameters, byte sequences)
- common/wc_http_sig.{c,h}: RFC 9421 Sign/Verify/GetKeyId API
- sign_request.c: Standalone signing example
- http_server_verify.c: Demo HTTP server with signature verification
- http_client_signed.c: Demo HTTP client sending signed requests
- test_vectors.c: 11 tests including RFC 9421 Appendix B.2.6
Design decisions:
- Ed25519-only (alg enforced on verify path)
- sigOut/inputOut are char* (NUL-terminated strings)
- Header names lowercased per RFC 9421 Section 2.1
- Portable case-insensitive comparison (no POSIX strcasecmp)
- SO_RCVTIMEO on server to prevent blocking on slow clients
- Signature base written directly to caller buffer (no double-buffer)
Known limitations:
- 32-bit long: parse_sf_integer caps at 9 digits, breaking current
UNIX timestamps (needs fix, see below)
- No content-digest, multi-signature, or full RFC 8941 support
- Duplicate headers: first match wins, no folding
Signed-off-by: Sameeh Jubran <sameeh@wolfssl.com>
|
2026-03-30 13:17:51 +03:00 |