mirrors/fep
1
0
Fork 0
mirror of https://codeberg.org/fediverse/fep.git synced 2026-08-05 19:55:46 +00:00
Code Packages Wiki Activity

FEP-521a: Update proposal (#603)

Browse Source 
- Formatting and grammar fixes.
- Removed same-origin recommendation.
- Removed FEP-c390 comparison.
- Updated references.

Reviewed-on: https://codeberg.org/fediverse/fep/pulls/603
Co-authored-by: silverpill <silverpill@firemail.cc>
Co-committed-by: silverpill <silverpill@firemail.cc>
This commit is contained in:
silverpill
2025-05-16 17:24:23 +00:00
committed by silverpill
parent cddfbb0f0a
commit d8441498dc
1 changed files with 15 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files
fep/521a/fep-521a.md
+15 -25
View File
@@ -17,7 +17,7 @@ This proposal describes how to represent public keys associated with [ActivityPu
Historically, Fediverse services used [publicKey](https://w3c-ccg.github.io/security-vocab/#publicKey) property to represent actor's public key. Implementations usually allow only one key per actor, therefore a new approach is needed to support use cases where additional keys are required.
Furthermore, `publicKey` property was removed from the latest version of [Security Vocabulary][SecurityVocabulary].
Furthermore, `publicKey` property is considered deprecated and is not present in the latest version of [Security Vocabulary][SecurityVocabulary].
## Requirements
@@ -30,11 +30,9 @@ Each public key MUST be represented as an object with `Multikey` type, as define
- `id`: the unique global identifier of the public key.
- `type`: the value of this property MUST be the string `Multikey`.
- `controller`: the value of this property MUST match actor ID.
- `publicKeyMultibase`: a [Multibase] encoded value of a [Multicodec] prefix and the key. Implementations MUST use the `base-58-btc` alphabet.
- `publicKeyMultibase`: a [Multibase] encoded value of a [Multicodec] prefix and the public key. Implementations MUST use the `base-58-btc` alphabet.
Key identifier and actor identifier SHOULD have the same [origin][FEP-fe34].
The `Multikey` object MAY contain the `expires` property indicating the expiration date of the key. Implementations MUST NOT not accept a signature created with a key that has been expired.
The `Multikey` object MAY contain the `expires` property indicating the expiration date of the key. Implementations MUST NOT not accept a signature created with a key that has expired.
### Key IDs
@@ -44,17 +42,17 @@ Resolution of a URI containing a fragment identifier is performed using the algo
### Key types
Implementers can use cryptographic keys of any type for which [Multicodec] prefix is registered.
Implementers can use cryptographic keys of any type for which a [Multicodec] prefix is registered.
## Controlled identifier document
## Adding keys to an actor object
`Multikey` objects MUST be added to the actor object, which is considered a controlled identifier document, as described in [Controlled Identifiers][ControlledIdentifiers] specification.
If the key is intended to be used for signing ActivityPub objects, it MUST be added to the [`assertionMethod`][Assertion] array in the actor object.
Other use cases are currently out of scope of this proposal.
Other use cases are out of scope of this proposal.
Implementations are discouraged from adding any objects to the `assertionMethod` array that does not conform to this specification. Implementations encountering non-conformant entries in the `assertionMethod` array SHOULD ignore them.
Implementations are discouraged from adding any objects to the `assertionMethod` array that do not conform to this specification. Implementations encountering non-conformant entries in the `assertionMethod` array SHOULD ignore them.
### Example
@@ -79,12 +77,6 @@ Implementations are discouraged from adding any objects to the `assertionMethod`
}
```
## Difference between this proposal and FEP-c390
[FEP-c390](https://codeberg.org/fediverse/fep/src/branch/main/fep/c390/fep-c390.md) describes how to link external identities to ActivityPub actor. Valid identity proof implies that actor and proof's subject are controlled by the same entity.
This proposal describes how to represent actor's public keys. The corresponding secret keys are controlled by the server.
## Test vectors
See [fep-521a.feature](./fep-521a.feature)
@@ -98,23 +90,21 @@ See [fep-521a.feature](./fep-521a.feature)
## References
- Christine Lemmer Webber, Jessica Tallon, [ActivityPub][ActivityPub], 2018
- Christine Lemmer-Webber, Jessica Tallon, Erin Shepherd, Amy Guy, Evan Prodromou, [ActivityPub], 2018
- Ivan Herman, Manu Sporny, Dave Longley, [Security Vocabulary][SecurityVocabulary], 2023
- S. Bradner, [Key words for use in RFCs to Indicate Requirement Levels][RFC-2119], 1997
- Dave Longley, Manu Sporny, Markus Sabadello, Drummond Reed, Orie Steele, Christopher Allen, [Controlled Identifiers (CIDs) v1.0][ControlledIdentifiers], 2025
- Dave Longley, Manu Sporny, Markus Sabadello, Drummond Reed, Orie Steele, Christopher Allen, [Controlled Identifiers v1.0][ControlledIdentifiers], 2025
- Protocol Labs, [Multicodec][Multicodec]
- silverpill, [FEP-fe34: Origin-based security model][FEP-fe34], 2024
[ActivityPub]: https://www.w3.org/TR/activitypub/
[SecurityVocabulary]: https://w3c.github.io/vc-data-integrity/vocab/security/vocabulary.html
[SecurityVocabulary]: https://www.w3.org/2025/credentials/vcdi/vocab/v2/vocabulary.html
[RFC-2119]: https://tools.ietf.org/html/rfc2119.html
[ControlledIdentifiers]: https://w3c.github.io/cid/
[Multikey]: https://w3c.github.io/cid/#Multikey
[Multibase]: https://w3c.github.io/cid/#multibase-0
[Assertion]: https://w3c.github.io/cid/#assertion
[FragmentResolution]: https://w3c.github.io/cid/#fragment-resolution
[ControlledIdentifiers]: https://www.w3.org/TR/cid-1.0/
[Multikey]: https://www.w3.org/TR/cid-1.0/#Multikey
[Multibase]: https://www.w3.org/TR/cid-1.0/#multibase-0
[Assertion]: https://www.w3.org/TR/cid-1.0/#assertion
[FragmentResolution]: https://www.w3.org/TR/cid-1.0/#fragment-resolution
[Multicodec]: https://github.com/multiformats/multicodec/
[FEP-fe34]: https://codeberg.org/fediverse/fep/src/branch/main/fep/fe34/fep-fe34.md
## Copyright