From d8441498dc6f7875dda7b0202fa6743b65a7297a Mon Sep 17 00:00:00 2001 From: silverpill Date: Fri, 16 May 2025 17:24:23 +0000 Subject: [PATCH] FEP-521a: Update proposal (#603) - Formatting and grammar fixes. - Removed same-origin recommendation. - Removed FEP-c390 comparison. - Updated references. Reviewed-on: https://codeberg.org/fediverse/fep/pulls/603 Co-authored-by: silverpill Co-committed-by: silverpill --- fep/521a/fep-521a.md | 40 +++++++++++++++------------------------- 1 file changed, 15 insertions(+), 25 deletions(-) diff --git a/fep/521a/fep-521a.md b/fep/521a/fep-521a.md index 03501dd..aeee503 100644 --- a/fep/521a/fep-521a.md +++ b/fep/521a/fep-521a.md @@ -17,7 +17,7 @@ This proposal describes how to represent public keys associated with [ActivityPu Historically, Fediverse services used [publicKey](https://w3c-ccg.github.io/security-vocab/#publicKey) property to represent actor's public key. Implementations usually allow only one key per actor, therefore a new approach is needed to support use cases where additional keys are required. -Furthermore, `publicKey` property was removed from the latest version of [Security Vocabulary][SecurityVocabulary]. +Furthermore, `publicKey` property is considered deprecated and is not present in the latest version of [Security Vocabulary][SecurityVocabulary]. ## Requirements @@ -30,11 +30,9 @@ Each public key MUST be represented as an object with `Multikey` type, as define - `id`: the unique global identifier of the public key. - `type`: the value of this property MUST be the string `Multikey`. - `controller`: the value of this property MUST match actor ID. -- `publicKeyMultibase`: a [Multibase] encoded value of a [Multicodec] prefix and the key. Implementations MUST use the `base-58-btc` alphabet. +- `publicKeyMultibase`: a [Multibase] encoded value of a [Multicodec] prefix and the public key. Implementations MUST use the `base-58-btc` alphabet. -Key identifier and actor identifier SHOULD have the same [origin][FEP-fe34]. - -The `Multikey` object MAY contain the `expires` property indicating the expiration date of the key. Implementations MUST NOT not accept a signature created with a key that has been expired. +The `Multikey` object MAY contain the `expires` property indicating the expiration date of the key. Implementations MUST NOT not accept a signature created with a key that has expired. ### Key IDs @@ -44,17 +42,17 @@ Resolution of a URI containing a fragment identifier is performed using the algo ### Key types -Implementers can use cryptographic keys of any type for which [Multicodec] prefix is registered. +Implementers can use cryptographic keys of any type for which a [Multicodec] prefix is registered. -## Controlled identifier document +## Adding keys to an actor object `Multikey` objects MUST be added to the actor object, which is considered a controlled identifier document, as described in [Controlled Identifiers][ControlledIdentifiers] specification. If the key is intended to be used for signing ActivityPub objects, it MUST be added to the [`assertionMethod`][Assertion] array in the actor object. -Other use cases are currently out of scope of this proposal. +Other use cases are out of scope of this proposal. -Implementations are discouraged from adding any objects to the `assertionMethod` array that does not conform to this specification. Implementations encountering non-conformant entries in the `assertionMethod` array SHOULD ignore them. +Implementations are discouraged from adding any objects to the `assertionMethod` array that do not conform to this specification. Implementations encountering non-conformant entries in the `assertionMethod` array SHOULD ignore them. ### Example @@ -79,12 +77,6 @@ Implementations are discouraged from adding any objects to the `assertionMethod` } ``` -## Difference between this proposal and FEP-c390 - -[FEP-c390](https://codeberg.org/fediverse/fep/src/branch/main/fep/c390/fep-c390.md) describes how to link external identities to ActivityPub actor. Valid identity proof implies that actor and proof's subject are controlled by the same entity. - -This proposal describes how to represent actor's public keys. The corresponding secret keys are controlled by the server. - ## Test vectors See [fep-521a.feature](./fep-521a.feature) @@ -98,23 +90,21 @@ See [fep-521a.feature](./fep-521a.feature) ## References -- Christine Lemmer Webber, Jessica Tallon, [ActivityPub][ActivityPub], 2018 +- Christine Lemmer-Webber, Jessica Tallon, Erin Shepherd, Amy Guy, Evan Prodromou, [ActivityPub], 2018 - Ivan Herman, Manu Sporny, Dave Longley, [Security Vocabulary][SecurityVocabulary], 2023 - S. Bradner, [Key words for use in RFCs to Indicate Requirement Levels][RFC-2119], 1997 -- Dave Longley, Manu Sporny, Markus Sabadello, Drummond Reed, Orie Steele, Christopher Allen, [Controlled Identifiers (CIDs) v1.0][ControlledIdentifiers], 2025 +- Dave Longley, Manu Sporny, Markus Sabadello, Drummond Reed, Orie Steele, Christopher Allen, [Controlled Identifiers v1.0][ControlledIdentifiers], 2025 - Protocol Labs, [Multicodec][Multicodec] -- silverpill, [FEP-fe34: Origin-based security model][FEP-fe34], 2024 [ActivityPub]: https://www.w3.org/TR/activitypub/ -[SecurityVocabulary]: https://w3c.github.io/vc-data-integrity/vocab/security/vocabulary.html +[SecurityVocabulary]: https://www.w3.org/2025/credentials/vcdi/vocab/v2/vocabulary.html [RFC-2119]: https://tools.ietf.org/html/rfc2119.html -[ControlledIdentifiers]: https://w3c.github.io/cid/ -[Multikey]: https://w3c.github.io/cid/#Multikey -[Multibase]: https://w3c.github.io/cid/#multibase-0 -[Assertion]: https://w3c.github.io/cid/#assertion -[FragmentResolution]: https://w3c.github.io/cid/#fragment-resolution +[ControlledIdentifiers]: https://www.w3.org/TR/cid-1.0/ +[Multikey]: https://www.w3.org/TR/cid-1.0/#Multikey +[Multibase]: https://www.w3.org/TR/cid-1.0/#multibase-0 +[Assertion]: https://www.w3.org/TR/cid-1.0/#assertion +[FragmentResolution]: https://www.w3.org/TR/cid-1.0/#fragment-resolution [Multicodec]: https://github.com/multiformats/multicodec/ -[FEP-fe34]: https://codeberg.org/fediverse/fep/src/branch/main/fep/fe34/fep-fe34.md ## Copyright