I wondered if there exists a defined mechanism similar to AWS4-HMAC-SHA256 (as a scheme in Authorization HTTP header), but using asymmetric algorithm, probably ed25519, and how secure it would be to be used for stateless authentication. This is assuming that things are done properly - the whole body, along with host, method, suitable set of headers and identity (which can be the public key itself) are signed with ed25519.

I wonder why I don't see such things coming up more frequently and even being standardized.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.