igor-pavlenko / httpsignatures-go Goto Github PK

I'm one of the authors of the HTTP Message Signatures spec, and I was pointed to this implementation. I wanted to let you know that there have been several major revisions since -00, and now that the major churn has settled down we'd love to see support for the updated spec.

https://www.ietf.org/archive/id/draft-ietf-httpbis-message-signatures-05.html

First of all, thank you for this great effort on implementing http signatures!

We're pulling it into a small helper API we're developing over at TrustBloc. We noticed the Sign implementation is using the secret key material directly. This blocks its usage in contexts where developers are using KMS APIs that follow current best practice, which include never export your secrets.

Would you guys be open to a PR that changed this such that instead of using a Secrets storage it would instead use a supplier of Signers ? The rough outline would be:

1. Fetch the signer using the keyId
2. Build the signature string
3. Invoke s, err := signer.Sign(sigstring)

tagging @igor-pavlenko