The request was authenticated and the callback was not

# Self-authored for the EML case corpus (no external origin). Every inbound
# request is authenticated and none has ever got through unsigned. What the
# outbound half proves is computed below.
#
# The inbound authentication is thorough. Requests carry a signature over the
# body and a timestamp, replays inside the window are rejected by a nonce cache,
# the signing keys are per-tenant and rotated, and four million two hundred
# thousand requests this month produced zero unsigned acceptances. A penetration
# test last quarter did not get past it.
#
# The API is asynchronous. It accepts work, returns immediately, and later POSTs
# the result to a URL the customer gave us — and that direction was designed as
# a notification rather than as a message anyone would act on.
#
# The callback carries no signature. A customer receiving one cannot distinguish
# it from a POST anybody made to the same URL.

4200000 => inbound_requests
0 => unsigned_accepted
4200000 => callbacks_sent
0 => callbacks_signed
1840 => customers
712 => customers_checking_the_source_address

customers - customers_checking_the_source_address => customers_with_no_check

"inbound requests            : " + str(inbound_requests) ^0
"accepted without a signature: " + str(unsigned_accepted) ^0
"" ^0
"callbacks sent              : " + str(callbacks_sent) ^0
"callbacks signed            : " + str(callbacks_signed) ^0
"customers                   : " + str(customers) ^0
"  checking the source address : " + str(customers_checking_the_source_address) ^0
"  checking nothing            : " + str(customers_with_no_check) ^0
"" ^0

# ---- what the inbound check verified ----

"the request authentication" ^0
"  signature over the body : required" ^0
"  timestamp window        : enforced" ^0
"  replay inside the window: rejected by a nonce cache" ^0
"  keys                    : per tenant, rotated" ^0
"  unsigned acceptances    : " + str(unsigned_accepted) ^0
"  penetration test        : did not get past it" ^0
"  verdict                 : AUTHENTICATED" ^0
"" ^0
"  this is not a token in a header; it is a real signing" ^0
"  scheme and it holds" ^0
"" ^0

# ---- what the outbound half carries ----

"the callback" ^0
"  signature      : none" ^0
"  shared secret  : none" ^0
"  mutual tls     : no" ^0
"  what a receiver can verify : that something POSTed" ^0
"    valid json to a url" ^0
"" ^0
"  the url is not secret either: it is submitted in the" ^0
"  request, logged by both sides, and often a path under a" ^0
"  documented prefix" ^0
"" ^0

int(customers_with_no_check * 10000 / customers) => unprotected_per_myriad
"customers acting on an unverifiable message : " + str(unprotected_per_myriad) + " per ten thousand" ^0
"" ^0

# ---- why the source address check is not the answer ----

# The 712 who check the source address are checking a list we publish and
# change. It is better than nothing and it is not authentication: it says the
# packet came from a range, not that the payload is ours or unmodified.
"what checking the source address establishes" ^0
"  the packet came from a published range : yes" ^0
"  the payload is the one we sent         : no" ^0
"  the payload has not been replayed      : no" ^0
"  customers relying on it                : " + str(customers_checking_the_source_address) ^0
"" ^0

# ---- null control ----

# The same API, signing the callback with the same per-tenant key the inbound
# direction already uses.
callbacks_sent => nc_callbacks_signed
0 => nc_customers_with_no_check

"null control - sign the callback with the same key" ^0
"  unsigned acceptances : " + str(unsigned_accepted) + ", unchanged" ^0
"  callbacks signed     : " + str(nc_callbacks_signed) ^0
"  customers with no check : " + str(nc_customers_with_no_check) ^0
"  the inbound side did not get stronger; the key it" ^0
"  already holds started being used in both directions" ^0
"" ^0

# ---- the rule ----

"what request authentication guarantees" ^0
"  we know who is asking : exactly" ^0
"  they know it is us    : not addressed, and the two are" ^0
"    different keys pointed in different directions even" ^0
"    when they are the same key" ^0
"" ^0
"authentication is directional; a scheme that answers 'is this" ^0
"caller real' says nothing about 'is this result real', and an" ^0
"asynchronous API asks the second question of its customers" ^0
"" ^0

"Every one of " + str(inbound_requests) + " inbound requests was authenticated and " + str(unsigned_accepted) + " unsigned ones" ^0
"were accepted: signature over the body, enforced timestamp, nonce cache,"  ^0
"per-tenant rotated keys, a penetration test that did not get past it. All" ^0
str(callbacks_sent) + " callbacks went out unsigned, so " + str(customers_with_no_check) + " of " + str(customers) + " customers - " + str(unprotected_per_myriad) ^0
"per ten thousand - act on a result they have no way to attribute to us." ^0

inbound_requests = 4200000
unsigned_accepted = 0
callbacks_sent = 4200000
callbacks_signed = 0
customers = 1840
customers_checking_the_source_address = 712
customers_with_no_check = customers - customers_checking_the_source_address
print("inbound requests            : " + str(inbound_requests))
print("accepted without a signature: " + str(unsigned_accepted))
print("")
print("callbacks sent              : " + str(callbacks_sent))
print("callbacks signed            : " + str(callbacks_signed))
print("customers                   : " + str(customers))
print("  checking the source address : " + str(customers_checking_the_source_address))
print("  checking nothing            : " + str(customers_with_no_check))
print("")
print("the request authentication")
print("  signature over the body : required")
print("  timestamp window        : enforced")
print("  replay inside the window: rejected by a nonce cache")
print("  keys                    : per tenant, rotated")
print("  unsigned acceptances    : " + str(unsigned_accepted))
print("  penetration test        : did not get past it")
print("  verdict                 : AUTHENTICATED")
print("")
print("  this is not a token in a header; it is a real signing")
print("  scheme and it holds")
print("")
print("the callback")
print("  signature      : none")
print("  shared secret  : none")
print("  mutual tls     : no")
print("  what a receiver can verify : that something POSTed")
print("    valid json to a url")
print("")
print("  the url is not secret either: it is submitted in the")
print("  request, logged by both sides, and often a path under a")
print("  documented prefix")
print("")
unprotected_per_myriad = int(customers_with_no_check * 10000 / customers)
print("customers acting on an unverifiable message : " + str(unprotected_per_myriad) + " per ten thousand")
print("")
print("what checking the source address establishes")
print("  the packet came from a published range : yes")
print("  the payload is the one we sent         : no")
print("  the payload has not been replayed      : no")
print("  customers relying on it                : " + str(customers_checking_the_source_address))
print("")
nc_callbacks_signed = callbacks_sent
nc_customers_with_no_check = 0
print("null control - sign the callback with the same key")
print("  unsigned acceptances : " + str(unsigned_accepted) + ", unchanged")
print("  callbacks signed     : " + str(nc_callbacks_signed))
print("  customers with no check : " + str(nc_customers_with_no_check))
print("  the inbound side did not get stronger; the key it")
print("  already holds started being used in both directions")
print("")
print("what request authentication guarantees")
print("  we know who is asking : exactly")
print("  they know it is us    : not addressed, and the two are")
print("    different keys pointed in different directions even")
print("    when they are the same key")
print("")
print("authentication is directional; a scheme that answers 'is this")
print("caller real' says nothing about 'is this result real', and an")
print("asynchronous API asks the second question of its customers")
print("")
print("Every one of " + str(inbound_requests) + " inbound requests was authenticated and " + str(unsigned_accepted) + " unsigned ones")
print("were accepted: signature over the body, enforced timestamp, nonce cache,")
print("per-tenant rotated keys, a penetration test that did not get past it. All")
print(str(callbacks_sent) + " callbacks went out unsigned, so " + str(customers_with_no_check) + " of " + str(customers) + " customers - " + str(unprotected_per_myriad))
print("per ten thousand - act on a result they have no way to attribute to us.")

inbound requests            : 4200000
accepted without a signature: 0

callbacks sent              : 4200000
callbacks signed            : 0
customers                   : 1840
  checking the source address : 712
  checking nothing            : 1128

the request authentication
  signature over the body : required
  timestamp window        : enforced
  replay inside the window: rejected by a nonce cache
  keys                    : per tenant, rotated
  unsigned acceptances    : 0
  penetration test        : did not get past it
  verdict                 : AUTHENTICATED

  this is not a token in a header; it is a real signing
  scheme and it holds

the callback
  signature      : none
  shared secret  : none
  mutual tls     : no
  what a receiver can verify : that something POSTed
    valid json to a url

  the url is not secret either: it is submitted in the
  request, logged by both sides, and often a path under a
  documented prefix

customers acting on an unverifiable message : 6130 per ten thousand

what checking the source address establishes
  the packet came from a published range : yes
  the payload is the one we sent         : no
  the payload has not been replayed      : no
  customers relying on it                : 712

null control - sign the callback with the same key
  unsigned acceptances : 0, unchanged
  callbacks signed     : 4200000
  customers with no check : 0
  the inbound side did not get stronger; the key it
  already holds started being used in both directions

what request authentication guarantees
  we know who is asking : exactly
  they know it is us    : not addressed, and the two are
    different keys pointed in different directions even
    when they are the same key

authentication is directional; a scheme that answers 'is this
caller real' says nothing about 'is this result real', and an
asynchronous API asks the second question of its customers

Every one of 4200000 inbound requests was authenticated and 0 unsigned ones
were accepted: signature over the body, enforced timestamp, nonce cache,
per-tenant rotated keys, a penetration test that did not get past it. All
4200000 callbacks went out unsigned, so 1128 of 1840 customers - 6130
per ten thousand - act on a result they have no way to attribute to us.

Trace event types