Subject: [OAUTH-WG] HTTP Signing

From: Justin Richer <[email-masked]>
Date: Mon, 20 Jan 2020 11:51:34 -0500

As many of you know, Annabelle and I have put forward a general-purpose HTTP Signing specification in the HTTP Working Group, at least initially based on the old Cavage signatures spec that’s been used in the wild. We expect a number of important changes to happen as it goes through the standards process (which is to say, we aren’t approaching this to get a stamp on existing code), including some key things that would allow it to be used for more advanced OAuth proof of possession work. I would fully expect that a fairly small profile of this new signature document would be sufficient for OAuth PoP tokens, replacing the expired draft-ietf-http-signatures spec. 

As I said in Singapore, I think that there’s room for this kind of thing alongside DPoP, which is much more focused and constrained than this is trying to be. 

The new draft is currently going through its call for adoption within the HTTP WG, and if you have any interest in this work moving forward, please join the thread on the HTTP list to show your support for the draft. The Call For Adoption is currently open and runs through Jan 31.

Thanks,
 — Justin