Redesign digestMultibase handling to enable transparent request signing
Nobody has claimed this yet.
Assessment
- Difficulty
- 5/5
- Estimated time
- Over a week
- Newbie friendliness
- 35/100
- Issue type
- Feature
- Clarity
- Mostly clear
- Activity status
- Quiet
- Tech stack
- javascript
- Domain
- api, cryptography, security
Research direction
Start by reading lib/http.js at the linked line and trace how digestMultibase enters request signing. Determine the design needed to sign it without decoding or imposing a hash algorithm, then verify that identical witness requests can be reused and that the resulting request and proof remain verifiable across Data Integrity suites.
Written by the indexing model from the issue text.
Description
Problem Statement
Using the decoded digestMultibase directly as the second parameter in digest to sign (proof || digestMultibase) introduces tight coupling and strict expectations on the underlying value, such as requiring a specific SHA-256 multihash.
https://github.com/digitalbazaar/hmbd/blob/6c1320489e61766f0122e9eb6ba58187fe513479/lib/http.js#L91
This approach introduces the following limitations:
- The witness service cannot remain truly oblivious, as it requires extra metadata and client-side knowledge to properly construct the hash.
- A client cannot reuse an identical witness request.
- Verification is problematic; while Data Integrity (DI) suites accept signed documents (the witness request and proof), they might not expose the internal mechanisms required to modify the value to sign.
Proposed Solution
Sign the request transparently without decoding the digestMultibase value.
Expected Benefits
- Eliminates specific hashing algorithm expectations from the witness service.
- Enables the reuse of identical witness requests by the client.
- Increases interoperability, allowing the witness service to be used across diverse systems.
- Dominant language
- JavaScript
- Stars
- 4
- Forks
- 1
- PR merge metrics
- No merged PRs in 30d
Getting set up
- Ships a Dockerfile or Docker Compose file
- No pull request template
- No contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from digitalbazaar/hmbd
-
Difficulty 5/5 Over a week Newbie friendliness 35/100
digitalbazaar/hmbd#4 ·
-
Difficulty 3/5 1-2 days Newbie friendliness 55/100
digitalbazaar/hmbd#3 ·
-
OSV
Difficulty 3/5 1-2 days Newbie friendliness 52/100
digitalbazaar/hmbd#2 ·
All issues in digitalbazaar/hmbd
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 64/100
-
bug code-annotation
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
quarto-dev/quarto-cli#15215 ·
Maintainers usually reply within 1 day
-
Difficulty 1/5 Under an hour Newbie friendliness 70/100
521xueweihan/HelloGitHub#4133 ·
-
Difficulty 1/5 1-3 hours Newbie friendliness 88/100
-
enhancement
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
Hugo-SA/receita-random#20 ·
Maintainers usually reply within 1 day