Disclaimer: I have no idea what I'm looking at.
Some tests fail, but I believe they have nothing to do with my changes
(fingers crossed). `make certs` doesn't work, I don't have `minica`
installed and don't want to litter my system with even more stuff. It's
bad enough that I got a shitload of Go dependencies downloaded when
running `make test`.
Co-authored-by: Lysander Trischler <twtxt@lyse.isobeef.org>
Reviewed-on: https://git.mills.io/saltyim/saltyim/pulls/186
Reviewed-by: James Mills <james@mills.io>
Co-authored-by: lyse <lyse@noreply@mills.io>
Co-committed-by: lyse <lyse@noreply@mills.io>
Alternative to #177
The way this works is:
Client:
- Client creates a normal `net/http.Request{}` object using the `Request()` function in `utils.go`. The `http.Request{}` object is then signed using the Client's Ed25519 private key.
- The HTTP Method and Path (_note this is important_) are hashed, as well as the request body (if any) using the FNV128a hashing algorithm.
- This hash is then signed by the Client's's Ed25519 private key.
- The resulting signature is then encoded to Base64 (_standard encoding_) and added to the HTTP headers as a `Signature:` header.
- In addition the Client's Ed25519 public key is added to the HTTP headers as `Signer:`
Server:
- The server calculates the same FNV128a hash of the HTTP Request Method and Path and the body (if any)
- The server decodes the HTTP header `Signature:`
- The server then uses the Client's Ed25519 public key in the HTTP header `Signer:` to verify the signature of the `Signature:` HTTP header which gives us back the original FNV128a hash the Client calculated for the request.
- The server then compares the Client's hash with the expected hash to see if they compare equally.
Co-authored-by: James Mills <1290234+prologic@users.noreply.github.com>
Co-authored-by: Jon Lundy <jon@xuu.cc>
Reviewed-on: https://git.mills.io/saltyim/saltyim/pulls/178
Reviewed-by: xuu <xuu@noreply@mills.io>
