CC necko > On Jul 22, 2026, at 10:14, Martin Tuhus <[email protected]> wrote: > > Hello, > > My name is Martin Tuhus, and I am preparing a scientific paper based on > research conducted at the University of Oslo. > > The paper examines web applications that use TLS-terminating intermediaries, > such as CDNs and WAFs. I developed and evaluated a prototype that uses HTTP > Message Signatures, Content-Digest, and selective field-level encryption to > protect communication beyond the TLS intermediary. > > RFC 9421: > https://www.rfc-editor.org/rfc/rfc9421.html > > RFC 9530: > https://www.rfc-editor.org/rfc/rfc9530.html > > I am also aware of the Signature-based Integrity proposal, which applies a > profile of RFC 9421 to signed web resources: > https://github.com/WICG/signature-based-sri > > My prototype currently relies on a Service Worker and an out-of-band verifier. > I am investigating whether the relevant functionality could instead be > integrated into browsers. In such a model, the browser could verify signed > responses before exposing them to the page, generate an origin-bound key for > signing selected requests, and retrieve the origin's verification key through > a trusted mechanism. > > I would greatly appreciate your perspective on three questions: > > 1. Is work involving RFC 9421 or RFC 9530 currently being considered in > Firefox, beyond the Signature-based Integrity use case? > > 2. Would native verification of signed origin responses and signing of > selected outgoing requests be compatible with the browser's networking > and security architecture? > > 3. When implementing HTTP Message Signatures the browser needs a public key > to check the signatures. Do you have any thoughts on how the public key > could securely be sent from the web application to the browser? > > Even a response of a few sentences would be highly valuable. With your > permission, I may quote or summarise the response in the paper. Please > indicate > whether your response represents a personal technical opinion, a team > perspective, or an official project position. > > The relevant section will be finalised on 5 August 2026, so a response before > that date would be greatly appreciated. > > Best regards, > > Martin Tuhus > University of Oslo > [email protected] > > -- > You received this message because you are subscribed to the Google Groups > "[email protected]" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > To view this discussion visit > https://groups.google.com/a/mozilla.org/d/msgid/dev-platform/fd429fd9-355e-48ab-9112-126deacba1e4n%40mozilla.org.
-- You received this message because you are subscribed to the Google Groups "[email protected]" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion visit https://groups.google.com/a/mozilla.org/d/msgid/dev-platform/347ADF20-158D-4A67-A3A7-E0EA97A59F17%40mozilla.com.
signature.asc
Description: Message signed with OpenPGP
