I wondered if there exists a defined mechanism similar to AWS4-HMAC-SHA256 (as a scheme in Authorization HTTP header), but using asymmetric algorithm, probably ed25519, and how secure it would be to be used for stateless authentication. This is assuming that things are done properly - the whole body, along with host, method, suitable set of headers and identity (which can be the public key itself) are signed with ed25519.

I wonder why I don't see such things coming up more frequently and even being standardized.


You must log in to answer this question.

Browse other questions tagged .