Visual RFC.
ALL RFCs / RFC 6376
Read the RFC ↗
RFC 6376 / MECHANISM GUIDE

Mutation and trust limits

05

Forwarding and list transformations can preserve or break signatures depending on which data change.

Related RFCs and changes

“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.

DIAGRAM§ 8 ↗
RFC 6376 · § 8EXAMPLE
3 / 3
Mutation and trust limitsForwarding and list transformations can preserve or break signatures depending on which data change.Mutation and trust limitsSigned Subject: MeetingChanged Subject: PaymentA valid signature still does not certify harmless content
03
Apply separate policy

Use authentication results alongside content and authorization policy.

Protocol participantThreat or exceptionProtocol controlSimplified drawings · precise section references
KEY POINT

Changing signed content can invalidate the signature.

  • Changing signed content can invalidate the signature.
  • A valid signature can still accompany spam or malicious content.
  • Algorithm and key-size guidance has changed since the original publication.
DETAILS

Examples are illustrative. Consult the linked RFC and its errata for implementation details.

Read the RFC section ↗

Diagrams simplify the RFC. Read the linked sections for complete requirements.

Privacy
All chapters in this RFC
  1. Signing domain and selector
  2. Canonicalization
  3. Body hash and selected headers
  4. DNS key verification
  5. Mutation and trust limits
RFC 9700 / CHAPTERS

Chapters

For full details, tables, algorithms, and exceptions, read the original RFC.

RFC status and corrections ↗