You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
In the current opentdf implementations for c++ and javascript it seems like we are double encoding the signatures. The spec for the root signature and policy binding it only mentions base64 wrapped hmac signature.
rootSignature.sig
String
The signature for the entire payload. \n\nExample of signature generation:\nBase64.encode(HMAC(BinaryOfAllHashesCombined, payloadKey))
policyBinding
Object
This contains a keyed hash that will provide cryptographic integrity on the policy object, such that it cannot be modified or copied to another TDF, without invalidating the binding. Specifically, you would have to have access to the key in order to overwrite the policy.This is Base64 encoding of HMAC(POLICY,KEY)
In my opinion the spec either needs to be updated or those clients need to adhere to what the spec says.
The text was updated successfully, but these errors were encountered:
In the current opentdf implementations for
c++
andjavascript
it seems like we are double encoding the signatures. The spec for the root signature and policy binding it only mentionsbase64
wrappedhmac
signature.In my opinion the spec either needs to be updated or those clients need to adhere to what the spec says.
The text was updated successfully, but these errors were encountered: