Hi Martin! We are actively looking at a related project called Web Application Integrity, Consistency and Transparency (WAICT). I would recommend you check it out.
https://waict.dev/ Best, Tom On Wednesday, July 22, 2026 at 2:03:18 PM UTC+2 Lars Eggert wrote: > CC necko > > > On Jul 22, 2026, at 10:14, Martin Tuhus <[email protected]> wrote: > > > > Hello, > > > > My name is Martin Tuhus, and I am preparing a scientific paper based on > research conducted at the University of Oslo. > > > > The paper examines web applications that use TLS-terminating > intermediaries, > > such as CDNs and WAFs. I developed and evaluated a prototype that uses > HTTP > > Message Signatures, Content-Digest, and selective field-level encryption > to > > protect communication beyond the TLS intermediary. > > > > RFC 9421: > > https://www.rfc-editor.org/rfc/rfc9421.html > > > > RFC 9530: > > https://www.rfc-editor.org/rfc/rfc9530.html > > > > I am also aware of the Signature-based Integrity proposal, which applies > a > > profile of RFC 9421 to signed web resources: > > https://github.com/WICG/signature-based-sri > > > > My prototype currently relies on a Service Worker and an out-of-band > verifier. > > I am investigating whether the relevant functionality could instead be > > integrated into browsers. In such a model, the browser could verify > signed > > responses before exposing them to the page, generate an origin-bound key > for > > signing selected requests, and retrieve the origin's verification key > through > > a trusted mechanism. > > > > I would greatly appreciate your perspective on three questions: > > > > 1. Is work involving RFC 9421 or RFC 9530 currently being considered in > > Firefox, beyond the Signature-based Integrity use case? > > > > 2. Would native verification of signed origin responses and signing of > > selected outgoing requests be compatible with the browser's networking > > and security architecture? > > > > 3. When implementing HTTP Message Signatures the browser needs a public > key to check the signatures. Do you have any thoughts on how the public key > could securely be sent from the web application to the browser? > > > > Even a response of a few sentences would be highly valuable. With your > > permission, I may quote or summarise the response in the paper. Please > indicate > > whether your response represents a personal technical opinion, a team > > perspective, or an official project position. > > > > The relevant section will be finalised on 5 August 2026, so a response > before > > that date would be greatly appreciated. > > > > Best regards, > > > > Martin Tuhus > > University of Oslo > > [email protected] > > > > -- > > You received this message because you are subscribed to the Google > Groups "[email protected]" group. > > To unsubscribe from this group and stop receiving emails from it, send > an email to [email protected]. > > To view this discussion visit > https://groups.google.com/a/mozilla.org/d/msgid/dev-platform/fd429fd9-355e-48ab-9112-126deacba1e4n%40mozilla.org > . > > -- You received this message because you are subscribed to the Google Groups "[email protected]" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion visit https://groups.google.com/a/mozilla.org/d/msgid/dev-platform/82df65ba-5213-4521-93ad-d0e4286cac3fn%40mozilla.org.
