RFC 9421 Testing endpoints?

I've sent an RFC-9421 signed POST request to https://activitypub.space/uid/1/inbox, it timed out. But that might be a problem on my end

I also saw an Announce activity coming from you. My server logs this error:

invalid HTTP signature: invalid 'signature' dictionary

Streams and Forte support RFC 9421, with fallback to an older signature method if it fails. (I'm commenting from a streams instance.)

I apologize that my technical understanding is very limited, but I'm happy to try some experiments if you want.

My instance has rfc9421 turned on for everything by default - and I'd be happy to send some test packets and report back. However from memory nodebb isn't able to parse activities - and I don't have any way to send "posts";  so it might be a bit challenging to figure out which condition caused any failures.

We do support activities, we just don't persist them. You can send Create(Note) just like everybody else, etc.

> My server logs this error:
>
> invalid HTTP signature: invalid 'signature' dictionary

Is that an error output by your server itself, or a reflection from mine?

Nevermind @silverpill@mitra.social, I updated activitypub.space again. Can you let me know if my Announces are still throwing that error?

Let me know if you are able to look into the timeout issue.

Are you sending RFC 9421 first or cavage-12 draft first?

Also this is a test to confirm verification.

@mradcliffe@nokoto.org I am sending 9421 first, then cavage when it fails.

@julian Hmm, I think I must be failing your 9421 request. I think I will have to add logging back.

@mradcliffe@nokoto.org if your software is open, I (or rather, my local AI <img class="not-responsive emoji" src="https://activitypub.space/assets/plugins/nodebb-plugin-emoji/emoji/android/1f633.png?v=f52195b43b7" title="" />) can do a deep dive.

@silverpill@mitra.social my laptop says the timeout is due to Mitra's 10s timeout (this may be incorrect), and to try again <img class="not-responsive emoji" src="https://activitypub.space/assets/plugins/nodebb-plugin-emoji/emoji/android/1f914.png?v=f52195b43b7" title="" /> activitypub.space is slow, it's hit by many scrapers and a 10+s response is not out of the ordinary.

@julian Thank you. Unfortunately, it's not open... Yet. I am working on trying to split out what makes nokoto.org unique.

I know that I get RFC9421 successes from Gush at least.

@julian

It works now, this time the response was quick (200 OK)

@silverpill @julian It’s working for me too. I did not realize more implementations were not going to include alg parameter. I do not have a good way of deriving alg from the public key so the only thing I can do is assume rsa-v1_5-sha256 if it’s missing. I know that’s not great, but maybe we should all just agree to include alg?

I guess @Edent feels the same way.

@mradcliffe @julian

If you send some messages to @example I can see if I'm able to validate their signatures.
It works with the ones Mastodon sends.

@mradcliffe @julian @Edent Agreed - my implementation adds the alg parameter.

But if I remember correctly, relying on algorithm ID alone is not always safe, and the key type should also be validated.

https://portswigger.net/web-security/jwt/algorithm-confusion

Thanks both!

I'll look into adding the alg parameter and circle back.

@Edent just tried to DM it from Loops and it doesn't recognize the account

@edent@mastodon.social okay. Hello @example@example.viii.fi !