Skip to content

v0.2.3

Latest
Latest

Choose a tag to compare

View all tags
@christhomas christhomas released this 25 Jul 16:31
· 2 commits to main since this release
v0.2.3
c6fcd46
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

A single RFC 8617 §5.1.1 hardening fix on the verify path: the ARC-Message-Signature must sign the From header. The public API (Seal, Verify, SealOptions, SealResult) is unchanged.

Fixed

  • Verify now requires the ARC-Message-Signature to sign the From header (RFC 8617 §5.1.1); a chain whose AMS h= omits From is treated as cv=fail (#31).
Assets 2
Loading