mmo-ref/dep-curl
1
0
Fork 0
mirror of https://github.com/curl/curl synced 2026-08-25 12:32:35 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 1
dep-curl/docs/cmdline-opts/httpsig-keyid.md
Sameeh Jubran a55731050e
httpsig: add RFC 9421 HTTP Message Signatures support 
Add support for signing outgoing HTTP requests per RFC 9421 using
Ed25519 or HMAC-SHA256 algorithms.

New libcurl options:
 - CURLOPT_HTTPSIG: signing algorithm ("ed25519" or "hmac-sha256")
 - CURLOPT_HTTPSIG_KEY: path to hex-encoded key file
 - CURLOPT_HTTPSIG_KEYID: key identifier for Signature-Input
 - CURLOPT_HTTPSIG_HEADERS: space-separated components to sign

New CLI flags: --httpsig, --httpsig-key, --httpsig-keyid,
--httpsig-headers

The crypto layer follows the sha256.c multi-backend pattern with
implementations for OpenSSL (EVP_DigestSign) and wolfSSL
(wc_ed25519_sign_msg). HMAC-SHA256 uses the existing Curl_hmacit()
infrastructure which works on all backends.

Verified by test 5000 to 5021

Assisted-by: Daniel Stenberg
Signed-off-by: Sameeh Jubran <sameeh@wolfssl.com>
Closes #22386
Closes #21239
2026-07-25 16:25:37 +02:00

625 B
Raw Permalink Blame History

c SPDX-License-Identifier Long Protocols Arg Help Category Added Multi Experimental See-also Example
Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al. curl httpsig-keyid HTTP <id> Key identifier for HTTP Message Signatures auth http 8.22.0 single yes
httpsig-algo
httpsig-key
--httpsig-algo ed25519 --httpsig-key key.hex --httpsig-keyid "my-key" $URL

--httpsig-keyid

The key identifier to include in the Signature-Input header when using RFC 9421 HTTP Message Signatures. This value appears as the keyid parameter and allows the server to look up the correct verification key.