Mailing-List: contact user-help@couchdb.apache.org; run by ezmlm
Precedence: bulk
Reply-To: user@couchdb.apache.org
Received-SPF: pass (nike.apache.org: domain of b.candler@pobox.com designates
 208.72.237.25 as permitted sender)
Date: Tue, 14 Apr 2009 10:12:41 +0100
From: Brian Candler <B.Candler@pobox.com>
To: mhammond@skippinet.com.au
Cc: user@couchdb.apache.org
Subject: Re: Proposal for digital signatures of documents
Message-ID: <20090414091241.GA20903@uk.tiscali.com>
References: <49E29B01.3040301@gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <49E29B01.3040301@gmail.com>
User-Agent: Mutt/1.5.17+20080114 (2008-01-14)

On Mon, Apr 13, 2009 at 11:53:05AM +1000, Mark Hammond wrote:
> Would it be possible to just list the field names rather than forcing  
> another object into the mix?
...
>       {
>         "_id" : "89a7stdg235",
>         "_rev" : "1-26476513",
>         "signed-fields: [ "message", "date", "author"]

I can see scope for document tampering, unless signed-fields is itself
(unconditionally) signed.

How useful is it in practice to sign part of a document? This sounds very
application-specific to me, and something that couchdb itself should not
concern itself with. Applications can still attach these partial signatures,
and validate them. If you want couchdb to honour them (e.g. in replication
or in view building), then there will have to be policies as to which fields
require signatures.

This might be a good application for a more "modular" couchdb though - e.g.
if it were easier to plug into the existing view engine to apply such
policies.