How do I verify the RFC 9530 Content-Digest header?

To verify the RFC 9530 Content-Digest header, you check that the digest value in the header matches the cryptographic hash of the HTTP message body. This ensures the body has not been altered in transit and is a required step when verifying RFC 9421 HTTP Message Signatures.

The Content-Digest header (RFC 9530) provides integrity protection for HTTP message bodies. It uses structured-field dictionaries to specify one or more hash algorithms (for example, sha-256 or sha-512) and their computed values over the raw bytes of the body. When verifying an RFC 9421 signature, you must first validate the Content-Digest to confirm the body is intact before checking the signature itself.

What the Content-Digest header does

RFC 9530 defines the Content-Digest header as a structured field that carries cryptographic digests of the HTTP message body. The header is a dictionary where each key is a hash algorithm name (for example, "sha-256" or "sha-512") and each value is the base64-encoded digest of the body bytes. For example:

Content-Digest: sha-256=:X48E9qOokqqrvdts8nOJRJN3OWDUoyWxBf7kbu9DBPE=:

This header is part of the HTTP message integrity framework alongside RFC 9421 (HTTP Message Signatures). The digest is computed over the exact bytes sent or received, including any transfer encoding. If the body is empty, the digest is computed over an empty byte sequence.

How to verify the Content-Digest

1. Extract the body bytes: read the raw bytes of the HTTP message body, preserving any transfer encoding.
2. Compute the digest: apply the hash algorithm specified in the Content-Digest header to the body bytes. For example, for sha-256, compute the SHA-256 hash and encode it in base64.
3. Compare digests: check that the computed digest matches the value in the Content-Digest header. If they do not match, the body has been altered and the message is invalid.
4. Proceed to signature verification: only after verifying the Content-Digest should you verify the RFC 9421 signature, which covers the headers and the digest-protected body.

Why verify Content-Digest with RFC 9421

RFC 9421 signatures cover selected HTTP headers and the message body by reference. The signature is computed over a canonicalized representation of the headers and the digest of the body (via the Content-Digest header). This means the signature cannot be valid unless the body digest is correct. Verifying the Content-Digest first ensures the body is integrity-protected before you trust the signature.

Do it with AlgoVoi

Use the free, open-source algovoi-rfc9421-verifier (v0.4.4) to verify both RFC 9421 signatures and RFC 9530 Content-Digest headers in one step. The verifier handles the structured-field parsing, digest computation, and signature validation for you.

• Install: pip install algovoi-rfc9421-verifier or npm install @algovoi/rfc9421-verifier
• Hosted verifier: verify.algovoi.co.uk/rfc9421

Start with the docs: docs.algovoi.co.uk/quickstart