2026-08-27 14:09 UTC
Replies (3)
-
@Edent@mastodon.social 2026-08-31 20:35
Hey, #Mastodon and #ActivityPub developers. How much skew do you allow before rejecting a message? I've just received something where the header is signed: Mon, 31 Aug 2026 20:09:54 GMT But the ActivityPub message was published: Mon, 31 Aug 2026 19:58:36 GMT That's a little over 10 minutes. Is that too much? Should I not care as long as the signature validates?
-
@dave@upp2.com 2026-08-27 14:53
@Edent@mastodon.social Currently on vacation so I might misremember, but afair the algorithm is already determined by the key used. So including it would do no harm, but is kind of redundant.
-
@fentiger@zotum.net 2026-08-27 16:23
@Edent@mastodon.social If the verifier chooses which algorithm to use from this header, without double-checking it against the key, there's a chance it'll be vulnerable to an "algorithm confusion attack". Here's what that looks like in the case of JWTs; the same problem could happen with RFC9421. The safe way to work out which algorithm to use is to dereference the keyid and then choose the algorithm which matches the type of the returned key.