Code change:
<del> HTTP Unprompted Authentication </del> <ins> The Signature HTTP Authentication Scheme </ins> draft-ietf-httpbis-unprompted-auth-latest Abstract <del> Existing HTTP authentication mechanisms are probeable in the sense that it is possible for an unauthenticated client to probe whether an </del> <ins> Existing HTTP authentication schemes are probeable in the sense that it is possible for an unauthenticated client to probe whether an </ins> origin serves resources that require authentication.  It is possible for an origin to hide the fact that it requires authentication by not generating Unauthorized status codes, however that only works with <del> non-cryptographic authentication schemes: cryptographic schemes (such as signatures or message authentication codes) require a fresh nonce to be signed, and there is no existing way for the origin to share such a nonce without exposing the fact that it serves resources that require authentication.  This document proposes a new non-probeable cryptographic authentication scheme. </del> <ins> non-cryptographic authentication schemes: cryptographic signatures require a fresh nonce to be signed, and there is no existing way for the origin to share such a nonce without exposing the fact that it serves resources that require authentication.  This document proposes a new non-probeable cryptographic authentication scheme. </ins> 1. <del> Existing HTTP authentication mechanisms (see HTTP) are probeable in the sense that it is possible for an unauthenticated client to probe </del> <ins> Existing HTTP authentication schemes (see HTTP) are probeable in the sense that it is possible for an unauthenticated client to probe </ins> whether an origin serves resources that require authentication.  It is possible for an origin to hide the fact that it requires authentication by not generating Unauthorized status codes, however that only works with non-cryptographic authentication schemes: <del> cryptographic schemes (such as signatures or message authentication codes) require a fresh nonce to be signed, and there is no existing way for the origin to share such a nonce without exposing the fact that it serves resources that require authentication.  This document proposes a new non-probeable cryptographic authentication scheme. Unprompted Authentication serves use cases in which a site wants to offer a service or capability only to "those who know" while all others are given no indication the service or capability exists.  The conceptual model is that of a "speakeasy".  "Knowing" is via an externally-defined mechanism by which keys are distributed.  For example, a company might offer remote employee access to company </del> <ins> cryptographic signatures require a fresh nonce to be signed, and there is no existing way for the origin to share such a nonce without exposing the fact that it serves resources that require authentication.  This document proposes a new non-probeable cryptographic authentication scheme. The Signature HTTP authentication scheme serves use cases in which a site wants to offer a service or capability only to "those who know" while all others are given no indication the service or capability exists.  The conceptual model is that of a "speakeasy".  "Knowing" is via an externally-defined mechanism by which keys are distributed. For example, a company might offer remote employee access to company </ins> services directly via its website using their employee credentials, or offer access to limited special capabilities for specific employees, while making discovering (probing for) such capabilities

Related discussion:
text: From Ilari Liusvaara on the : From NAME on the :
Maybe also consider for identification. That's not perfect, because of the "none" thing, but it might be a better fit. The TLS schemes are generally OK provided that you only use the recommended ones (of which there aren't many).
I don't love JWA since , but using TLS SignatureScheme with a requirement to only use the recommended ones sounds good to me.
NAME Doesn't it define the algorithm and then define the subkey types and in ?
NAME that could be made to work though it's quite clunky since it requires a separate string parameter for "alg". Overall I think the is a much better fit for signatures here. We already tightly integrate with TLS but not JWA. All that said, the closest option for hashes is the and that's been orphaned by RFC 8447. At this point I guess we should bite the bullet and define a new registry. Perhaps we include as current values: hmac-sha256 hmac-sha384 hmac-sha512 signature-rsapkcs1sha256 signature-rsapkcs1sha384 signature-rsapkcs1sha512 signature-ecdsasecp256r1sha256 signature-ecdsasecp384r1sha384 signature-ecdsasecp521r1sha512 signature-rsapssrsaesha256 signature-rsapssrsaesha384 signature-rsapssrsaesha512 signature-rsapsspsssha256 signature-rsapsspsssha384 signature-rsapsspsssha512 signature-ed25519 signature-ed448 Of course this requires to paint the bikeshed one of two colors: HMAC and Signatures in the same registry, using a single new auth scheme Separate registries, using separate auth schemes Thoughts? At this point I suspect this issue will need WG discussion at IETF 116.
I had to implement rsapsspss_shaX algorithms to produce test vectors for DCs, and unless there's a really compelling reason to include them, I'd really rather not. They're just such a pain to use, and the support for them is very poor (thus me needing to implement them).
FWIW, adding an entry in the registry doesn't mean it'll be mandatory to implement so there's not much of a cost.