HTTP Message Signatures

Metadata

Publisher: IETF
Doc Type: Standard
Pages: 95
Abstract: This document describes a mechanism for creating, encoding, and verifying digital signatures or message authentication codes over components of an HTTP message. This mechanism supports use cases where the full HTTP message may not be known to the signer and where the message may be transformed (e.g., by intermediaries) before reaching the verifier. This document also describes a means for requesting that a signature be applied to a subsequent HTTP message in an ongoing HTTP exchange.
Publication Date: 2024-02-01
Status Note: Proposed Standard
DOI: 10.17487/RFC9421
Link: https://doi.org/10.17487/RFC9421
Author(s): Annabelle Backman
Justin Richer
Manu Sporny
Keyword(s): PKI

Latest version of IETF RFC 9421

Document Versions — IETF RFC 9421

▶ IETF RFC 9421 (2024-02-01)

THIS DOC [ACTIVE] [LATEST VERSION]

Normative Reference(s)

NIST.FIPS.186-5 — FIPS186-5 EXTERNAL
IEEE, "The Open Group Base Specifications Issue 7, 2018 edition", 2018, <https://pubs.opengroup.org/onlinepubs/9699919799/>. EXTERNAL
IETF RFC 20 [Active*]
IETF RFC 2104 [Active, Amended*]
IETF RFC 2119 [Active*]
IETF RFC 3986 [Active, Amended*]
IETF RFC 5234 [Active, Amended*]
IETF RFC 6234 [Active*]
IETF RFC 7517 [Active*]
IETF RFC 7518 [Active*]
IETF RFC 8017 [Active*]
IETF RFC 8032 [Active*]
IETF RFC 8174 [Active*]
IETF RFC 8941 [Superseded*]
IETF RFC 9110 [Active*]
IETF RFC 9112 [Active*]
WHATWG.URL — WHATWG-URL EXTERNAL

Bibliographic Reference(s)

10.1145-3319535.3339813 — JACKSON2019 EXTERNAL
IETF.draft-cavage-http-signatures-12 — Signing HTTP Messages EXTERNAL
IETF.draft-ietf-oauth-signed-http-request-03 — SIGNING-HTTP-REQS-OAUTH EXTERNAL
Amazon Simple Storage Service, "Authenticating Requests (AWS Signature Version 4)", March 2006, <https://docs.aws.amazon.com/AmazonS3/latest/API/sig-v4-authenticating-requests.html>. EXTERNAL
IETF RFC 6265 [Active*]
IETF RFC 7239 [Active*]
IETF RFC 7468 [Active*]
IETF RFC 7515 [Active*]
IETF RFC 7807 [Superseded*]
IETF RFC 8126 [Active*]
IETF RFC 8446 [Superseded*]
IETF RFC 8792 [Active*]
IETF RFC 8996 [Active*]
IETF RFC 9440 [Active*]
IETF RFC 9457 [Active*]
IETF RFC 9530 [Active*]

Source Data (JSON)

Full registry record with provenance metadata. Open directly: /api/doc/RFC9421.json

Reference Tree

Explore all references and references to this document, as a navigable tree.

Open Reference Tree

Reference this Doc

Plain text (ISO 690 compliant)

Preview:

IETF RFC 9421, HTTP Message Signatures. Available at https://doi.org/10.17487/RFC9421

Snippet:

IETF RFC 9421, HTTP Message Signatures. Available at https://doi.org/10.17487/RFC9421

HTML (ISO 690 compliant)

Preview:

IETF RFC 9421, HTTP Message Signatures. Available at https://doi.org/10.17487/RFC9421

Snippet:

<span class="citation"><cite>IETF RFC 9421</cite>, HTTP Message Signatures. Available at <a href="https://doi.org/10.17487/RFC9421" target="_blank" rel="noopener">https://doi.org/10.17487/RFC9421</a></span>

SMPTE's HTML Pub

Preview:

IETF RFC 9421, HTTP Message Signatures
doi: 10.17487/RFC9421
url: https://doi.org/10.17487/RFC9421

Snippet:

<li>
<cite id="bib-rfc9421">IETF RFC 9421</cite>, HTTP Message Signatures
<span class="doi">10.17487/RFC9421</span>
</li>

Referenced By

IETF RFC 9530 [Active*]