Comments on James Clark's Random Thoughts: Integrity without confidentiality

Digest authentication has an optional integrity ch...

2007-10-11T08:28:00.000+07:00

Digest authentication has an optional integrity check. However, you still need to provide a password, so it's integrity without confidentiality, but not without authentication. Also, caching is still problematic (while you could associate CC: public with it, checking integrity from a cached copy wouldn't be possible), and persisting it would still be a problem.

How about a new header, something like

Content-HMAC: hash="..."; key="http://example.org/key"

(where people who really care will protect the key with https)

The issue with this approach is that you have to buffer the whole response before signing it. Two approaches to that are using a HTTP trailer (easy to persist, but not well-supported), and using a chunk-ext (which *may* be easier to support, but harder to persist, and probably even more streaming-friendly).

Return multipart/signed content where one p...

2007-10-09T20:04:00.000+07:00

Return multipart/signed content where one part is the response (eg text/css) and a second part is a application/pkcs7-signature digital signature.

RFC 1847 Secure Multiparts for MIME
RFC 3851 S/MIME v3.1 message specification
RFC 4134 Examples of S/MIME Messages
(section 4.8)

Now... do you know how to get browsers to support this?

A similar requirement for "message-based" integrit...

2007-10-08T23:12:00.000+07:00

A similar requirement for "message-based" integrity was discovered when the Atom Syntax RFC was being drafted. Syndication feeds are frequently composed of entries that are extracted from a variety of other feeds and aggregated together. Of course, one is then left wondering if an aggregated entry is, in fact, a faithful copy of the original. Thus, Atom provides for signing not only an entire Atom feed but also signing of the individual entries within the feed. Thus, when a signed entry is aggregated into another feed, it maintains the signature it was given in its "source" feed.
This ability to aggregate signed entries will become very important when syndication feeds are used to aggregate event information, offers-to-buy, offers-to-sell, etc. whose integrity must be established before they can be relied upon. Supporting such aggregation without loss of integrity is only one of many ways that Atom supports application models that are far more useful than what RSS can support...

bob wyman

Technically, TLS (SSL) does support null encryptio...

2007-10-07T22:45:00.000+07:00

Technically, TLS (SSL) does support null encryption which is a signing-only mode. See the TLS_RSA_WITH_NULL_MD5 and TLS_RSA_WITH_NULL_SHA algorithms in RFC 2246.

However it's still not practical because almost no web browsers or servers support the null encryption modes (at least in their default configurations), and the HTTP caching techniques used today are not quite good enough, because even in signing-only mode TLS still employees a handshake.