Skip to content

Instantly share code, notes, and snippets.

View Stexxen's full-sized avatar

Steven Stexxen

4 followers · 3 following
  • Kent, England
View GitHub Profile
@Stexxen
Stexxen / CSF Signature and Verification.md
Last active September 4, 2025 12:00

Signing and Verifying using Public/Private Keys

The subject of Signing and Verifying messages in the frame of the CSF is based on the concept of a joined pair of keys, called the public and private key. The private key is kept secret while the public key being available to all. Both keys can encrypt data, but only the other key can decrypt that data.

This means that if you have some data that has been encrypted by a 3rd party, and you have their private key, and it decrypts correctly, then you know that the data definitely came from that 3rd party, as only they could have encrypted it. These concepts form the basics of Signing and Verifying. Further information can be acquired from https://en.wikipedia.org/wiki/Public-key_cryptography and https://en.wikipedia.org/wiki/Digital_signature

Domain Key Identified Messages (DKIM)

DKIM is an RFC Standard https://datatracker.ietf.org/doc/html/rfc6376 and sets out a specific method for using public/private keys to sign and verify messages. Effectively the sende

@Stexxen
Stexxen / Verification_Testing_Endpoints.md
Last active September 9, 2025 18:38

Verification Testing endpoint

There are 2 endpoints setup for testing.

/csf/T/letterbox/2.0/post.txt

Used in 1st stage development. Success returns 200, failure gives 403. The Response body is a timed text log of all the detailed steps that the system used to verify the message. In the case of failure this should be valuable in identifying where things are going wrong.

/csf/T/letterbox/2.0/post.json

Used to submit messages to a production-like CSF endpoint. The errors will be formated in the same way as Production CSF messages, success is 204, failure is 403. No further processing on the messages is performed.