B.2.2. Selective Covered Components Using rsa-pss-sha512

B.2.2. Selective Covered Components Using rsa-pss-sha512

This example covers additional components (the authority, the Content-Digest header field, and a single named query parameter) in test-request using the rsa-pss-sha512 algorithm. This example also adds a tag parameter with the application-specific value of header- example.

The corresponding signature base is:

NOTE: '' line wrapping per RFC 8792

"@authority": example.com "content-digest": sha-512=:WZDPaVn/7XgHaAy8pmojAkGWoRx2UFChF41A2svX
+TaPm+AbwAgBWnrIiYllu7BNNyealdVLvRwEmTHWXvJwew==: "@query-param";name="Pet": dog "@signature-params": ("@authority" "content-digest"
"@query-param";name="Pet")
;created=1618884473;keyid="test-key-rsa-pss"
;tag="header-example"

This results in the following Signature-Input and Signature header fields being added to the message under the label sig-b22:

NOTE: '' line wrapping per RFC 8792

Signature-Input: sig-b22=("@authority" "content-digest"
"@query-param";name="Pet");created=1618884473
;keyid="test-key-rsa-pss";tag="header-example" Signature: sig-b22=:LjbtqUbfmvjj5C5kr1Ugj4PmLYvx9wVjZvD9GsTT4F7GrcQ
EdJzgI9qHxICagShLRiLMlAJjtq6N4CDfKtjvuJyE5qH7KT8UCMkSowOB4+ECxCmT
8rtAmj/0PIXxi0A0nxKyB09RNrCQibbUjsLS/2YyFYXEu4TRJQzRw1rLEuEfY17SA
RYhpTlaqwZVtR8NV7+4UKkjqpcAoFqWFQh62s7Cl+H2fjBSpqfZUJcsIk4N6wiKYd
4je2U/lankenQ99PZfB4jY3I5rSV2DSBVkSFsURIjYErOs0tFTQosMTAoxk//0RoK
UqiYY8Bh0aaUEb0rQl3/XaVe4bXTugEjHSw==:

Note that the RSA-PSS algorithm in use here is non-deterministic, meaning that a different signature value will be created every time the algorithm is run. The signature value provided here can be validated against the given keys, but newly generated signature values are not expected to match the example. See Section 7.3.5.