Require validation of a covered Content-Digest

[aurel-fr]

Location

§11.2 line 1139, §11.4 lines 1189–1195, and §20 line 1472.

Problem

The draft repeatedly requires an HTTP Message Signature to cover content-digest, but never requires the verifier to validate that field against the received content.

Coverage authenticates the field value; it does not establish that the field describes the received body. RFC 9421 §7.2.8 identifies this content-substitution risk. RFC 9530 defines validation but permits recipients to ignore digests, so Human Continuity must explicitly require it before claiming content binding.

The requirement is currently repeated across three sections, creating unnecessary text and opportunities for drift.

Proposed resolution

Make §11.4 the single normative source:

If a holder-bound presentation includes a Content-Digest field covered by the HTTP Message Signature, the verifier MUST validate the received content against that field in accordance with RFC 9530 before returning valid. Validation MUST succeed using at least one digest algorithm acceptable for this use. If no acceptable digest is present or validation fails, the presentation is invalid; if validation cannot be completed, it is unverifiable.

Then:

• replace the duplicate requirement in §11.2 with a reference to §11.4;
• reduce §20 to a concise security warning and reference to §11.4; and
• retain the operation-specific guidance in §11.4.

This fixes the validation gap while shortening and centralizing the content-binding rules.