Subject: Security and Privacy considerations for Signatures

From: Justin Richer <[email-masked]>
Date: Tue, 2 Nov 2021 11:47:43 -0400

All,

As discussed at the interim, we’ve pushed up a PR to add security and privacy considerations for the signatures draft. Please review when you can:

https://github.com/httpwg/http-extensions/pull/1776 <https://github.com/httpwg/http-extensions/pull/1776>

And importantly, please help us expand this as necessary. Are there other attacks we should enumerate? Are there other aspects we should highlight? Are there other mitigations and tradeoffs that implementors should be aware of?

Thanks,

 — Justin