#fep_8b32 — Public Fediverse posts

FEP-8b32 update: https://codeberg.org/fediverse/fep/pulls/874

- Recommendation for expired proofs: try other authentication methods.
- Added a link to Quantum-Resistant Cryptosuites v1.0
- Added Mastodon to the implementation list (verification only for now)

#fep_8b32

FEP-8b32 (Object Integrity Proofs) is getting updated: https://codeberg.org/fediverse/fep/pulls/839

I added two new requirements:

- Objects identified using fragment IDs SHOULD NOT have integrity proofs. It is enough to secure the top-level document.
- Verifiers SHOULD ignore proofs that use unsupported algorithms and verification methods. This requirement provides forward compatibility, which is important because sooner or later we will need to use different algorithms.

#fep_8b32 #fep #fedidev

Updating FEP-8b32: https://codeberg.org/fediverse/fep/pulls/700

- The recommendation of same-origin check was removed in favor of same-owner check. This change makes FEP-8b32 aligned with Controlled Identifiers specification. Implementers are still advised to follow FEP-fe34 recommendations in the "Security considerations" section (FEP-fe34 recommends both same-origin and same-owner checks), although this FEP is referenced in a non-normative way (in order to not block finalization of FEP-8b32).
- Data integrity context was changed to v2 in examples and test vectors: https://w3id.org/security/data-integrity/v2.
- Added "Privacy considerations" section discussing the possibility of exposing private data.
- New implementation: Gush.

#fep_8b32

I am working on a new revision of FEP-8b32:

https://codeberg.org/fediverse/fep/pulls/527

There are many editorial changes, such as replacing Controller Documents with Controlled Identifiers, new implementation (apsig), and one new requirement:

>The identifier of the verification method MUST have the same origin as the identifier of the secured document, or have a different origin, but with an established cross-origin trust relationship to the identifier of the secured document.

This is related to today's FEP-fe34 update and should cover all possible uses of integrity proofs, including regular objects signed with DID keys, and portable objects (FEP-ef61). I expect that all existing implementations of FEP-8b32 already meet this new requirement, but if not, please let me know. I'll keep this PR open / WIP for a couple of days.

#fep_8b32 #fep

I'm updating FEP-8b32 test vectors, following the change in eddsa-jcs-2022 specification:

https://codeberg.org/fediverse/fep/pulls/338/files#diff-1e489c1864238669a9e6344a26cc62c4e4219b88

#fep_8b32

Proof generation and verification algorithms in eddsa-jcs-2022 cryptosuite are changing:

https://socialhub.activitypub.rocks/t/fep-8b32-object-integrity-proofs/2725/73

#fep_8b32 #fep_ef61