Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Problem type if the server does not want to compute digests #20

Open
Acconut opened this issue Oct 16, 2024 · 0 comments
Open

Problem type if the server does not want to compute digests #20

Acconut opened this issue Oct 16, 2024 · 0 comments

Comments

@Acconut
Copy link
Member

Acconut commented Oct 16, 2024

Let's assume that the server receives a request including an integrity field and content. While the server recognizes the presence of an integrity digest, it is not interested in using the digest to verify the integrity of the message content. For example because it wants to save computational cost associated with computing integrity digests.

The server could ignore the integrity fields and process the request without them. However, the client then has no knowledge that the server ignores the digests and cannot distinguish between cases where the server successfully verified the integrity and where the server ignored the digest altogether. This scenario is not always ideal because integrity may be violated without the server raising an error and thus the client believes no violation occurred.

The server could also choose to reject the request saying that it acknowledges the presence of the integrity fields but cannot guarantee integrity because it doesn't check the digests. The client can then decide to resend the request without integrity fields knowing that the content's integrity isn't verified or to abort the operation if integrity is of high importance.

If the server chooses to do the latter, can it use the unsupported algorithm problem type even if there is no algorithm that the server would accept? Should we introduce a new problem types for this situation?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant