### RSA-PSS-SHA512 Signature Base (Legacy sf-string) Source: https://www.ietf.org/archive/id/draft-ietf-webbotauth-httpsig-protocol-00.txt Signature base for the RSA-PSS-SHA512 example with legacy sf-string Signature-Agent. Retained for migration; do not use in new deployments. ```http "@authority": example.com "signature-agent": "https://signature-agent.test" "@signature-params": ("@authority" "signature-agent")\ ;created=1735689600\ ;keyid="oD0HwocPBSfpNy5W3bpJeyFGY_IQ_YpqxSjQ3Yd-CLA"\ ;alg="rsa-pss-sha512"\ ;expires=1735693200\ ;nonce="XSHtZVCThSIAksXsH9WBs6AtxtXC0eQGiIcUGSoJstFs8lAWakjhrfwzLhyjtme5iXMZvmFWqDEs6cT3Jf+BbQ=="\ ;tag="web-bot-auth" ``` -------------------------------- ### RSA-PSS-SHA512 Signature Headers (Legacy sf-string) Source: https://www.ietf.org/archive/id/draft-ietf-webbotauth-httpsig-protocol-00.txt Signature-Input and Signature headers for the RSA-PSS-SHA512 example with legacy sf-string Signature-Agent. Retained for migration; do not use in new deployments. ```http Signature-Agent: "https://signature-agent.test" Signature-Input: sig2=("@authority" "signature-agent")\ ;created=1735689600\ ;keyid="oD0HwocPBSfpNy5W3bpJeyFGY_IQ_YpqxSjQ3Yd-CLA"\ ;alg="rsa-pss-sha512"\ ;expires=1735693200\ ;nonce="XSHtZVCThSIAksXsH9WBs6AtxtXC0eQGiIcUGSoJstFs8lAWakjhrfwzLhyjtme5iXMZvmFWqDEs6cT3Jf+BbQ=="\ ;tag="web-bot-auth" Signature: sig2=:I1QWNzGXdP1a4dSvOHLCVOOanEYHDk+ZsVxM9MLX/p4ko69ghKwR5EOtAD96g7g4GWP7lmpM/jFAf9q8EFRDTPLjUXySwMv4YPgabv2LQihTJG2y8a2m6IGltyruwQNiqSJVUuRaG9+b17CGmAMFZh30X6GXLdQJrCARpeTqPwp2DC+a8haDE/VE5EruqzjA5/2mKwvrkzkSqeW5tOVtFwWRRHIOidquf/8Je6kM9mhgkg4arudLA5SL4wyyYE1jURIgcOl8agrfdJ5Def23DIRtiOLRa8jT9cpTLFAuFHN+mrZA/LH9h0gSIg1cPb+0cMASee5uku1KjWcFer7jWA==: ``` -------------------------------- ### Directory fetch request and response with JWKS Source: https://www.ietf.org/archive/id/draft-ietf-webbotauth-httpsig-protocol-00.txt Example request to fetch the directory at the well-known URI and the corresponding 200 OK response with a JWKS body. The directory must be served over HTTPS with media type application/http-message-signatures-directory+json. ```http GET /.well-known/http-message-signatures-directory HTTP/1.1 Host: example.com Accept: application/http-message-signatures-directory+json ``` ```http HTTP/1.1 200 OK Content-Type: application/http-message-signatures-directory+json Cache-Control: max-age=86400 { "keys": [{ "kty": "OKP", "crv": "Ed25519", "kid": "NFcWBst6DXG-N35nHdzMrioWntdzNZghQSkjHNMMSjw", "x": "JrQLj5P_89iXES9-vFgrIy29clF9CC_oPPsw3c5D0bs", "use": "sig", "nbf": 1712793600, "exp": 1715385600 }] } ``` -------------------------------- ### Signature-Agent member examples for directory, jwks_uri, and cimd Source: https://www.ietf.org/archive/id/draft-ietf-webbotauth-httpsig-protocol-00.txt Shows the three Signature-Agent member forms: default directory (no type parameter), jwks_uri, and cimd. The type parameter names how the URL resolves to key material. ```http Signature-Agent: sig1="https://signature-agent.test" Signature-Agent: sig1="https://signature-agent.test/jwks.json";type=jwks_uri Signature-Agent: sig1="https://signature-agent.test/card";type=cimd ``` -------------------------------- ### RSA-PSS-SHA512 Signature Headers (Dictionary Form) Source: https://www.ietf.org/archive/id/draft-ietf-webbotauth-httpsig-protocol-00.txt Signature-Input and Signature headers for the RSA-PSS-SHA512 example with dictionary-form Signature-Agent. The signature is computed over the corresponding signature base. ```http Signature-Agent: agent2="https://signature-agent.test" Signature-Input: sig2=("@authority" "signature-agent";key="agent2")\ ;created=1735689600\ ;keyid="oD0HwocPBSfpNy5W3bpJeyFGY_IQ_YpqxSjQ3Yd-CLA"\ ;alg="rsa-pss-sha512"\ ;expires=4889289600\ ;nonce="wcfPQPh7SzkvrIVvhD00vNk9PkxJNY2NVbYl2PVBB4zmUoluSwE7W6bPtF60QA3k8g06FU7PPCD+J58YofY1zg=="\ ;tag="web-bot-auth" Signature: sig2=:gHzpLNeHaHIO19NaJH9YMW5dcVSi2s0wOMBr6p18vcofS106sfC4KBIS0/szPlBBd1vIcyQ88B6CTEWIhRAiVrb9zfX0mx1aG12CSGWcYkSirHeyTxhbuJvXd27ed6skWoy4PjXItq38936ivUQjfdIwXh1aX6HxkAC3vRnEdSNfntkLWeEuIQ5BLIOBGE39fSwg27Qjq6OVWYas/9/aFUr3HA34MXWYdp+//cvlEKDp3kRoLOw9ro0AOr6srHrTeEtxon2afcws1aZVSlPdd2fZSEIGmw9HAHLDCEkFTERu1gH2k/zIEqgy7CAYXI9E5slog0cLg/Vc6+f8gih33g==: ``` -------------------------------- ### Ed25519 Signature Headers (Dictionary Form) Source: https://www.ietf.org/archive/id/draft-ietf-webbotauth-httpsig-protocol-00.txt Signature-Input and Signature headers for the Ed25519 example with dictionary-form Signature-Agent. The signature is computed over the corresponding signature base. ```http Signature-Agent: agent2="https://signature-agent.test" Signature-Input: sig2=("@authority" "signature-agent";key="agent2")\ ;created=1735689600\ ;keyid="poqkLGiymh_W0uP6PZFw-dvez3QJT5SolqXBCW38r0U"\ ;alg="ed25519"\ ;expires=4889289600\ ;nonce="n9p433xm+NJ3ph3upfBIGmsuwHw387YV7Q/F+6BSpGCVjYCqQw6rznNA8PVVLySrAWsv0hQtFioQb6E1YsauiA=="\ ;tag="web-bot-auth" Signature: sig2=:RdNFx5Bj6au3YgAMQL/RzmUlZE8QZLIaXGRpw985hWnwPfMxT228NMk6ehRS1PSl4e8PhbNZACSanGdhEwYCCg==: ``` -------------------------------- ### HTTP Request with Signature Headers Source: https://www.ietf.org/archive/id/draft-ietf-webbotauth-httpsig-protocol-00.txt Example of a signed HTTP request using the web-bot-auth profile. Includes the Signature, Signature-Input, and Signature-Agent headers. The Signature-Input header uses line wrapping per RFC 8792. ```http GET /path/to/resource HTTP/1.1 Host: origin.example.com Signature: sig=abc== Signature-Input: sig=("@authority" "signature-agent";key="sig");\ created=1700000000;\ expires=1700011111;\ keyid="ba3e64==";\ tag="web-bot-auth" Signature-Agent: sig="https://signer.example.com" ``` -------------------------------- ### Ed25519 Signature Headers (Legacy sf-string) Source: https://www.ietf.org/archive/id/draft-ietf-webbotauth-httpsig-protocol-00.txt Signature-Input and Signature headers for the Ed25519 example with legacy sf-string Signature-Agent. Retained for migration; do not use in new deployments. ```http Signature-Agent: "https://signature-agent.test" Signature-Input: sig2=("@authority" "signature-agent")\ ;created=1735689600\ ;keyid="poqkLGiymh_W0uP6PZFw-dvez3QJT5SolqXBCW38r0U"\ ;alg="ed25519"\ ;expires=4889289600\ ;nonce="n9p433xm+NJ3ph3upfBIGmsuwHw387YV7Q/F+6BSpGCVjYCqQw6rznNA8PVVLySrAWsv0hQtFioQb6E1YsauiA=="\ ;tag="web-bot-auth" Signature: sig2=:RdNFx5Bj6au3YgAMQL/RzmUlZE8QZLIaXGRpw985hWnwPfMxT228NMk6ehRS1PSl4e8PhbNZACSanGdhEwYCCg==: ``` -------------------------------- ### Ed25519 Signature Base (Legacy sf-string) Source: https://www.ietf.org/archive/id/draft-ietf-webbotauth-httpsig-protocol-00.txt Signature base for the Ed25519 example with legacy sf-string Signature-Agent. Retained for migration; do not use in new deployments. ```http "@authority": example.com "signature-agent": "https://signature-agent.test" "@signature-params": ("@authority" "signature-agent")\ ;created=1735689600\ ;keyid="poqkLGiymh_W0uP6PZFw-dvez3QJT5SolqXBCW38r0U"\ ;alg="ed25519"\ ;expires=4889289600\ ;nonce="n9p433xm+NJ3ph3upfBIGmsuwHw387YV7Q/F+6BSpGCVjYCqQw6rznNA8PVVLySrAWsv0hQtFioQb6E1YsauiA=="\ ;tag="web-bot-auth" ``` -------------------------------- ### Ed25519 Signature Base (Dictionary Form) Source: https://www.ietf.org/archive/id/draft-ietf-webbotauth-httpsig-protocol-00.txt Signature base for the Ed25519 example with dictionary-form Signature-Agent. Used to validate the signature computation. ```http "@authority": example.com "signature-agent";key="agent2": "https://signature-agent.test" "@signature-params": ("@authority" "signature-agent";key="agent2")\ ;created=1735689600\ ;keyid="poqkLGiymh_W0uP6PZFw-dvez3QJT5SolqXBCW38r0U"\ ;alg="ed25519"\ ;expires=4889289600\ ;nonce="n9p433xm+NJ3ph3upfBIGmsuwHw387YV7Q/F+6BSpGCVjYCqQw6rznNA8PVVLySrAWsv0hQtFioQb6E1YsauiA=="\ ;tag="web-bot-auth" ```