mirror of
https://codeberg.org/fediverse/fep.git
synced 2026-08-05 11:46:04 +00:00
FEP-8b32: Update proposal (#287)
- Moved examples into a new section. - Clarified verification method retrieval. - Removed mention of RSASSA-PKCS1-v1_5 algorithm. - Added "Special cases" section. - Added Streams and Hubzilla to implementation list. - Changed contact address. Reviewed-on: https://codeberg.org/fediverse/fep/pulls/287 Reviewed-by: helge <helge@noreply.codeberg.org> Co-authored-by: silverpill <silverpill@firemail.cc> Co-committed-by: silverpill <silverpill@firemail.cc>
This commit is contained in:
silverpill
silverpill
+64
-48
@@ -1,6 +1,6 @@
|
||||
---
|
||||
slug: "8b32"
|
||||
authors: silverpill <silverpill@firemail.cc>
|
||||
authors: silverpill <@silverpill@mitra.social>
|
||||
status: DRAFT
|
||||
dateReceived: 2022-11-12
|
||||
relatedFeps: FEP-521a
|
||||
@@ -40,59 +40,19 @@ The process of proof generation consists of the following steps:
|
||||
|
||||
The resulting proof is added to the original JSON object under the key `proof`. Objects MAY contain multiple proofs.
|
||||
|
||||
Example of unsigned activity:
|
||||
The list of attributes used in integrity proof is defined in *Data Integrity* specification, section [2.1 Proofs](https://w3c.github.io/vc-data-integrity/#proofs). The proof type SHOULD be `DataIntegrityProof`, as specified in section [3.1 DataIntegrityProof](https://w3c.github.io/vc-data-integrity/#dataintegrityproof). The value of `proofPurpose` attribute MUST be `assertionMethod`.
|
||||
|
||||
```json
|
||||
{
|
||||
"@context": [
|
||||
"https://www.w3.org/ns/activitystreams",
|
||||
"https://w3id.org/security/data-integrity/v1"
|
||||
],
|
||||
"type": "Create",
|
||||
"actor": "https://server.example/users/alice",
|
||||
"object": {
|
||||
"type": "Note",
|
||||
"content": "Hello world"
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
Example of activity with integrity proof:
|
||||
|
||||
```json
|
||||
{
|
||||
"@context": [
|
||||
"https://www.w3.org/ns/activitystreams",
|
||||
"https://w3id.org/security/data-integrity/v1"
|
||||
],
|
||||
"type": "Create",
|
||||
"actor": "https://server.example/users/alice",
|
||||
"object": {
|
||||
"type": "Note",
|
||||
"content": "Hello world"
|
||||
},
|
||||
"proof": {
|
||||
"type": "DataIntegrityProof",
|
||||
"cryptosuite": "eddsa-jcs-2022",
|
||||
"verificationMethod": "https://server.example/users/alice#ed25519-key",
|
||||
"proofPurpose": "assertionMethod",
|
||||
"proofValue": "z3sXaxjKs4M3BRicwWA9peyNPJvJqxtGsDmpt1jjoHCjgeUf71TRFz56osPSfDErszyLp5Ks1EhYSgpDaNM977Rg2",
|
||||
"created": "2023-02-24T23:36:38Z"
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
The list of attributes used in integrity proof is defined in *Data Integrity* specification, section [2.1 Proofs](https://w3c.github.io/vc-data-integrity/#proofs). The proof type SHOULD be `DataIntegrityProof`, as specified in section [3.1 DataIntegrityProof](https://w3c.github.io/vc-data-integrity/#dataintegrityproof). The value of `verificationMethod` attribute SHOULD be an URL of actor's public key or a [DID][DIDs] associated with an actor. The value of `proofPurpose` attribute MUST be `assertionMethod`.
|
||||
The value of the `verificationMethod` attribute of the proof can be an URL of a public key or a [DID][DIDs]. The [controller document](https://w3c.github.io/vc-data-integrity/#controller-documents) where verification method is expressed MUST be an actor object or another document that can be provably associated with an [ActivityPub] actor (e.g. a [DID][DIDs] document).
|
||||
|
||||
### Proof verification
|
||||
|
||||
The recipient of activity SHOULD perform proof verification if it contains integrity proofs. Verification process MUST follow the *Data Integrity* specification, section [4.5 Verify Proof](https://w3c.github.io/vc-data-integrity/#verify-proof). It starts with the removal of a `proof` value from the JSON object. Then the object is canonicalized, hashed and signature verification is performed according to the parameters specified in the proof.
|
||||
Recipients of an object SHOULD perform proof verification if it contains integrity proofs. Verification process MUST follow the *Data Integrity* specification, section [4.5 Verify Proof](https://w3c.github.io/vc-data-integrity/#verify-proof). It starts with the removal of the `proof` value from the JSON object. Then verification method is retrieved from the controller document as described in section [4.7 Retrieve Verification Method](https://w3c.github.io/vc-data-integrity/#retrieve-verification-method). Then the object is canonicalized, hashed and signature verification is performed according to the parameters specified in the proof.
|
||||
|
||||
If both HTTP signature and integrity proof are used, the integrity proof MUST be given precedence over HTTP signature. The HTTP signature MAY be dismissed.
|
||||
|
||||
### Algorithms
|
||||
|
||||
Implementers SHOULD pursue broad interoperability when choosing algorithms for integrity proofs.
|
||||
Implementers are expected to pursue broad interoperability when choosing algorithms for integrity proofs.
|
||||
|
||||
[eddsa-jcs-2022][eddsa-jcs-2022] cryptosuite is RECOMMENDED:
|
||||
|
||||
@@ -102,9 +62,7 @@ Implementers SHOULD pursue broad interoperability when choosing algorithms for i
|
||||
|
||||
**WARNING: eddsa-jcs-2022 cryptosuite specification is not stable and may change before it becomes a W3C Recommendation. In particular, the processing of nested objects is not [well defined](https://github.com/w3c/vc-data-integrity/issues/231).**
|
||||
|
||||
Support for **RSASSA-PKCS1-v1_5** signature algorithm is OPTIONAL but could be desirable for interoperability with legacy systems.
|
||||
|
||||
### Backwards compatibility
|
||||
### Backward compatibility
|
||||
|
||||
Integrity proofs and linked data signatures can be used together, as they rely on different properties (`proof` and `signature`, respectively).
|
||||
|
||||
@@ -112,6 +70,62 @@ If compatiblity with legacy systems is desired, the integrity proof MUST be crea
|
||||
|
||||
If both `proof` and `signature` are present in a received object, the linked data signature MUST be removed before the verification of the integrity proof.
|
||||
|
||||
### Special cases
|
||||
|
||||
#### Activities
|
||||
|
||||
The controller of the verification method MUST match the actor of activity, or be associated with that actor.
|
||||
|
||||
## Examples
|
||||
|
||||
### Signed object
|
||||
|
||||
```json
|
||||
{
|
||||
"@context": [
|
||||
"https://www.w3.org/ns/activitystreams",
|
||||
"https://w3id.org/security/data-integrity/v1"
|
||||
],
|
||||
"type": "Note",
|
||||
"attributedTo": "https://server.example/users/alice",
|
||||
"content": "Hello world",
|
||||
"proof": {
|
||||
"type": "DataIntegrityProof",
|
||||
"cryptosuite": "eddsa-jcs-2022",
|
||||
"verificationMethod": "https://server.example/users/alice#ed25519-key",
|
||||
"proofPurpose": "assertionMethod",
|
||||
"proofValue": "...",
|
||||
"created": "2023-02-24T23:36:38Z"
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
### Signed activity
|
||||
|
||||
```json
|
||||
{
|
||||
"@context": [
|
||||
"https://www.w3.org/ns/activitystreams",
|
||||
"https://w3id.org/security/data-integrity/v1"
|
||||
],
|
||||
"type": "Create",
|
||||
"actor": "https://server.example/users/alice",
|
||||
"object": {
|
||||
"type": "Note",
|
||||
"attributedTo": "https://server.example/users/alice",
|
||||
"content": "Hello world"
|
||||
},
|
||||
"proof": {
|
||||
"type": "DataIntegrityProof",
|
||||
"cryptosuite": "eddsa-jcs-2022",
|
||||
"verificationMethod": "https://server.example/users/alice#ed25519-key",
|
||||
"proofPurpose": "assertionMethod",
|
||||
"proofValue": "...",
|
||||
"created": "2023-02-24T23:36:38Z"
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
## Test vectors
|
||||
|
||||
See [fep-8b32.feature](./fep-8b32.feature)
|
||||
@@ -122,6 +136,8 @@ See [fep-8b32.feature](./fep-8b32.feature)
|
||||
- Vervis
|
||||
([generation](https://codeberg.org/ForgeFed/Vervis/commit/e8e587af26944d3ea8d91f5c47cc3058cf261387),
|
||||
[verification](https://codeberg.org/ForgeFed/Vervis/commit/621275e25762a1c1e5860d07a6ff87b147deed4f))
|
||||
- Streams
|
||||
- [Hubzilla](https://hub.somaton.com/channel/mario?mid=4214a375-3a18-4acb-b546-75c6c4818e2f)
|
||||
|
||||
## References
|
||||
|
||||
|
||||
Reference in New Issue
Block a user