{"action":"created","issue":{"url":"https://api.github.com/repos/briansmith/ring/issues/40","labels_url":"https://api.github.com/repos/briansmith/ring/issues/40/labels{/name}","comments_url":"https://api.github.com/repos/briansmith/ring/issues/40/comments","events_url":"https://api.github.com/repos/briansmith/ring/issues/40/events","html_url":"https://github.com/briansmith/ring/issues/40","id":112966754,"number":40,"title":"Add `ring::hmac::verify_self_signature`","user":{"login":"briansmith","id":16816,"avatar_url":"https://avatars.githubusercontent.com/u/16816?v=3","gravatar_id":"","url":"https://api.github.com/users/briansmith","html_url":"https://github.com/briansmith","followers_url":"https://api.github.com/users/briansmith/followers","following_url":"https://api.github.com/users/briansmith/following{/other_user}","gists_url":"https://api.github.com/users/briansmith/gists{/gist_id}","starred_url":"https://api.github.com/users/briansmith/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/briansmith/subscriptions","organizations_url":"https://api.github.com/users/briansmith/orgs","repos_url":"https://api.github.com/users/briansmith/repos","events_url":"https://api.github.com/users/briansmith/events{/privacy}","received_events_url":"https://api.github.com/users/briansmith/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-10-23T07:18:12Z","updated_at":"2015-10-25T22:29:59Z","closed_at":"2015-10-25T22:29:59Z","body":"Looking at https://github.com/badboy/nobsign/pull/1, it is obvious that the HMAC API is a little off, in the case where HMAC is being used to sign something we created, pass it around, get it back, and then verify that the thing was something created by us. In particular, *ring*'s current HMAC API is optimized for protocols like SSH and TLS where you we verify things signed by another party, and where we want to make sure we don't use use the same key for signing stuff we send that we use for verifying stuff that the other party sends.\r\n\r\nI think we can improve the API here by simply adding:\r\n\r\n```\r\npub fn verify_self_signature(key: &SigningKey, data: &[u8], sig: &[u8])\r\n```\r\n\r\nIt would be just like `ring::hmac::verify`, except taking a `SigningKey` instead of a `VerificationKey`. The name would make it clear that this is to only be used for self-signatures.\r\n\r\nI wonder if the AEAD interface needs something similar."},"comment":{"url":"https://api.github.com/repos/briansmith/ring/issues/comments/150980386","html_url":"https://github.com/briansmith/ring/issues/40#issuecomment-150980386","issue_url":"https://api.github.com/repos/briansmith/ring/issues/40","id":150980386,"user":{"login":"briansmith","id":16816,"avatar_url":"https://avatars.githubusercontent.com/u/16816?v=3","gravatar_id":"","url":"https://api.github.com/users/briansmith","html_url":"https://github.com/briansmith","followers_url":"https://api.github.com/users/briansmith/followers","following_url":"https://api.github.com/users/briansmith/following{/other_user}","gists_url":"https://api.github.com/users/briansmith/gists{/gist_id}","starred_url":"https://api.github.com/users/briansmith/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/briansmith/subscriptions","organizations_url":"https://api.github.com/users/briansmith/orgs","repos_url":"https://api.github.com/users/briansmith/repos","events_url":"https://api.github.com/users/briansmith/events{/privacy}","received_events_url":"https://api.github.com/users/briansmith/received_events","type":"User","site_admin":false},"created_at":"2015-10-25T22:29:59Z","updated_at":"2015-10-25T22:29:59Z","body":"Fixed with commit https://github.com/briansmith/ring/commit/e78a64dc54457265452dd21a99719a432b411fe9."}}