Hello, My name is Martin Tuhus, and I am preparing a scientific paper based on research conducted at the University of Oslo.
The paper examines web applications that use TLS-terminating intermediaries, such as CDNs and WAFs. I developed and evaluated a prototype that uses HTTP Message Signatures, Content-Digest, and selective field-level encryption to protect communication beyond the TLS intermediary. RFC 9421: https://www.rfc-editor.org/rfc/rfc9421.html RFC 9530: https://www.rfc-editor.org/rfc/rfc9530.html I am also aware of the Signature-based Integrity proposal, which applies a profile of RFC 9421 to signed web resources: https://github.com/WICG/signature-based-sri My prototype currently relies on a Service Worker and an out-of-band verifier. I am investigating whether the relevant functionality could instead be integrated into browsers. In such a model, the browser could verify signed responses before exposing them to the page, generate an origin-bound key for signing selected requests, and retrieve the origin's verification key through a trusted mechanism. I would greatly appreciate your perspective on three questions: 1. Is work involving RFC 9421 or RFC 9530 currently being considered in Firefox, beyond the Signature-based Integrity use case? 2. Would native verification of signed origin responses and signing of selected outgoing requests be compatible with the browser's networking and security architecture? 3. When implementing HTTP Message Signatures the browser needs a public key to check the signatures. Do you have any thoughts on how the public key could securely be sent from the web application to the browser? Even a response of a few sentences would be highly valuable. With your permission, I may quote or summarise the response in the paper. Please indicate whether your response represents a personal technical opinion, a team perspective, or an official project position. The relevant section will be finalised on 5 August 2026, so a response before that date would be greatly appreciated. Best regards, Martin Tuhus University of Oslo [email protected] -- You received this message because you are subscribed to the Google Groups "[email protected]" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion visit https://groups.google.com/a/mozilla.org/d/msgid/dev-platform/fd429fd9-355e-48ab-9112-126deacba1e4n%40mozilla.org.
