How to Verify HTTP Message Signatures (RFC 9421)

Verifying HTTP message signatures ensures the integrity and authenticity of requests and responses. This guide explains how to verify signatures per RFC 9421, covering the signature base, headers, and components involved. It also introduces AlgoVoi's free, open-source tools to simplify implementation.

What You Need to Verify a Signature

To verify an HTTP message signature, you must: 1. Reconstruct the signature base: The string that was signed, derived from the HTTP message components. 2. Extract the signature: Provided in the Signature header. 3. Verify the signature: Using the public key of the signer.

Key Components of RFC 9421

1. Signature-Input Header

This header defines the components included in the signature and the algorithm used. Example:

Signature-Input: sig1=("@method" "@target-uri" "@authority" "content-digest" "content-length");keyid="test-key-rsa-pss";alg="rsa-pss-sha512"

• Components: The fields covered by the signature (e.g., @method, @target-uri, content-digest).
• Key ID: Identifies the key used to sign the message.
• Algorithm: Specifies the signing algorithm (e.g., rsa-pss-sha512, ed25519).

2. Signature Header

This header contains the actual signature. Example:

Signature: sig1=:base64-encoded-signature-here:

3. Content-Digest Header (RFC 9530)

The Content-Digest header provides a hash of the request or response body, ensuring its integrity. Example:

Content-Digest: sha-512=:base64-encoded-digest-here:

Steps to Verify a Signature

Step 1: Reconstruct the Signature Base

The signature base is a string constructed from the HTTP message components listed in the Signature-Input header. Each component is formatted as:

"component-name": component-value

For example, if the Signature-Input includes @method, @target-uri, and content-digest, the signature base would look like:

"@method": POST
"@target-uri": https://api.algovoi.co.uk/resource
"content-digest": sha-512=:base64-encoded-digest-here:

Step 2: Extract the Signature

The signature is provided in the Signature header. Decode the base64-encoded signature to obtain the binary signature.

Step 3: Verify the Signature

Use the public key corresponding to the keyid in the Signature-Input header to verify the signature against the reconstructed signature base. AlgoVoi's tools support Ed25519 and other algorithms defined in RFC 9421.

Tools to Simplify Verification

1. AlgoVoi RFC 9421 Verifier (Free & Open Source)

AlgoVoi provides a free, open-source verifier to help you implement RFC 9421 quickly. The verifier supports: - Ed25519 and other RFC 9421-compliant algorithms. - RFC 9530 Content-Digest verification. - Signature base reconstruction and validation.

Install the Package

The verifier is available as a Python package. Install it using pip:

pip install algovoi-rfc9421-verifier

Hosted Verifier

AlgoVoi also offers a hosted verifier for testing and development.

2. Example Workflow

Here's how you can use the verifier in your application:

from algovoi_rfc9421_verifier import verify_http_signature

# Example HTTP message components
headers = {
    "Signature-Input": 'sig1=("@method" "@target-uri" "content-digest");keyid="test-key-ed25519";alg="ed25519"',
    "Signature": "sig1=:base64-encoded-signature-here:",
    "Content-Digest": "sha-512=:base64-encoded-digest-here:",
}
method = "POST"
target_uri = "https://api.algovoi.co.uk/resource"
body = b'{"message": "Hello, world!"}'

# Verify the signature
public_key = "base64-encoded-public-key-here"
is_valid = verify_http_signature(headers, method, target_uri, body, public_key)

print("Signature is valid:", is_valid)

Why Use AlgoVoi's Tools?

• Compliance-Ready: Built to adhere to RFC 9421 and RFC 9530 standards.
• Open Source: Free to use and modify under the Apache 2.0 license.
• Developer-Friendly: Easy integration with existing systems.

Get Started

Ready to implement HTTP message signatures? Start with the AlgoVoi RFC 9421 Verifier documentation.