Support signing and verifying the Digest header

Author: cjslep

README.md

@@ -13,6 +13,7 @@ signing of hash schemes. Its goals are:
 * Remaining flexible with headers included in the signing string
 * Support both HTTP requests and responses
 * Explicitly not support known-cryptographically weak algorithms
+* Support automatic signing and validating Digest headers
 
 ## How to use
 
@@ -25,14 +26,18 @@ Signing a request or response requires creating a new `Signer` and using it:
 ```
 func sign(privateKey crypto.PrivateKey, pubKeyId string, r *http.Request) error {
 	prefs := []httpsig.Algorithm{httpsig.RSA_SHA512, httpsig.RSA_SHA256}
+	digestAlgorithm := DigestSha256
 	// The "Date" and "Digest" headers must already be set on r, as well as r.URL.
 	headersToSign := []string{httpsig.RequestTarget, "date", "digest"}
-	signer, chosenAlgo, err := httpsig.NewSigner(prefs, headersToSign, httpsig.Signature)
+	signer, chosenAlgo, err := httpsig.NewSigner(prefs, digestAlgorithm, headersToSign, httpsig.Signature)
 	if err != nil {
 		return err
 	}
+	// To sign the digest, we need to give the signer a copy of the body...
+	// ...but it is optional, no digest will be signed if given "nil"
+	body := ...
 	// If r were a http.ResponseWriter, call SignResponse instead.
-	return signer.SignRequest(privateKey, pubKeyId, r)
+	return signer.SignRequest(privateKey, pubKeyId, r, body)
 }
 ```
 
@@ -51,7 +56,10 @@ func (s *server) handlerFunc(w http.ResponseWriter, r *http.Request) {
 	// Set headers and such on w
 	s.mu.Lock()
 	defer s.mu.Unlock()
-	err := s.signer.SignResponse(privateKey, pubKeyId, w)
+	// To sign the digest, we need to give the signer a copy of the response body...
+	// ...but it is optional, no digest will be signed if given "nil"
+	body := ...
+	err := s.signer.SignResponse(privateKey, pubKeyId, w, body)
 	if err != nil {
 		...
 	}
@@ -76,6 +84,7 @@ func verify(r *http.Request) error {
 	pubKeyId := verifier.KeyId()
 	var algo httpsig.Algorithm = ...
 	var pubKey crypto.PublicKey = ...
+	// The verifier will verify the Digest in addition to the HTTP signature
 	return verifier.Verify(pubKey, algo)
 }
 ```

digest.go

@@ -62,6 +62,27 @@ func addDigest(r *http.Request, algo DigestAlgorithm, b []byte) (err error) {
 	return
 }
 
+func addDigestResponse(r http.ResponseWriter, algo DigestAlgorithm, b []byte) (err error) {
+	_, ok := r.Header()[digestHeader]
+	if ok {
+		err = fmt.Errorf("cannot add Digest: Digest is already set")
+		return
+	}
+	var h hash.Hash
+	var a DigestAlgorithm
+	h, a, err = getHash(algo)
+	if err != nil {
+		return
+	}
+	sum := h.Sum(b)
+	r.Header().Add(digestHeader,
+		fmt.Sprintf("%s%s%s",
+			a,
+			digestDelim,
+			base64.StdEncoding.EncodeToString(sum[:])))
+	return
+}
+
 func verifyDigest(r *http.Request, body *bytes.Buffer) (err error) {
 	d := r.Header.Get(digestHeader)
 	if len(d) == 0 {

httpsig.go

@@ -107,7 +107,14 @@ type Signer interface {
 	// is expected to be of type []byte. If the Signer was created using an
 	// RSA based algorithm, then the private key is expected to be of type
 	// *rsa.PrivateKey.
-	SignRequest(pKey crypto.PrivateKey, pubKeyId string, r *http.Request) error
+	//
+	// A Digest (RFC 3230) will be added to the request. The body provided
+	// must match the body used in the request, and is allowed to be nil.
+	// The Digest ensures the request body is not tampered with in flight,
+	// and if the signer is created to also sign the "Digest" header, the
+	// HTTP Signature will then ensure both the Digest and body are not both
+	// modified to maliciously represent different content.
+	SignRequest(pKey crypto.PrivateKey, pubKeyId string, r *http.Request, body []byte) error
 	// SignResponse signs the response using a private key. The public key
 	// id is used by the HTTP client to identify which key to use to verify
 	// the signature.
@@ -116,7 +123,14 @@ type Signer interface {
 	// is expected to be of type []byte. If the Signer was created using an
 	// RSA based algorithm, then the private key is expected to be of type
 	// *rsa.PrivateKey.
-	SignResponse(pKey crypto.PrivateKey, pubKeyId string, r http.ResponseWriter) error
+	//
+	// A Digest (RFC 3230) will be added to the response. The body provided
+	// must match the body written in the response, and is allowed to be
+	// nil. The Digest ensures the response body is not tampered with in
+	// flight, and if the signer is created to also sign the "Digest"
+	// header, the HTTP Signature will then ensure both the Digest and body
+	// are not both modified to maliciously represent different content.
+	SignResponse(pKey crypto.PrivateKey, pubKeyId string, r http.ResponseWriter, body []byte) error
 }
 
 // NewSigner creates a new Signer with the provided algorithm preferences to
@@ -125,20 +139,23 @@ type Signer interface {
 // algorithms were available, then the default algorithm is used. The headers
 // specified will be included into the HTTP signatures.
 //
+// The Digest will also be calculated on a request's body using the provided
+// digest algorithm, if "Digest" is one of the headers listed.
+//
 // The provided scheme determines which header is populated with the HTTP
 // Signature.
 //
 // An error is returned if an unknown or a known cryptographically insecure
 // Algorithm is provided.
-func NewSigner(prefs []Algorithm, headers []string, scheme SignatureScheme) (Signer, Algorithm, error) {
+func NewSigner(prefs []Algorithm, dAlgo DigestAlgorithm, headers []string, scheme SignatureScheme) (Signer, Algorithm, error) {
 	for _, pref := range prefs {
-		s, err := newSigner(pref, headers, scheme)
+		s, err := newSigner(pref, dAlgo, headers, scheme)
 		if err != nil {
 			continue
 		}
 		return s, pref, err
 	}
-	s, err := newSigner(defaultAlgorithm, headers, scheme)
+	s, err := newSigner(defaultAlgorithm, dAlgo, headers, scheme)
 	return s, defaultAlgorithm, err
 }
 
@@ -187,11 +204,12 @@ func NewResponseVerifier(r *http.Response) (Verifier, error) {
 	})
 }
 
-func newSigner(algo Algorithm, headers []string, scheme SignatureScheme) (Signer, error) {
+func newSigner(algo Algorithm, dAlgo DigestAlgorithm, headers []string, scheme SignatureScheme) (Signer, error) {
 	s, err := signerFromString(string(algo))
 	if err == nil {
 		a := &asymmSigner{
 			s:            s,
+			dAlgo:        dAlgo,
 			headers:      headers,
 			targetHeader: scheme,
 			prefix:       scheme.authScheme(),
@@ -204,6 +222,7 @@ func newSigner(algo Algorithm, headers []string, scheme SignatureScheme) (Signer
 	}
 	c := &macSigner{
 		m:            m,
+		dAlgo:        dAlgo,
 		headers:      headers,
 		targetHeader: scheme,
 		prefix:       scheme.authScheme(),