[Docs] [txt|pdf] [Tracker] [WG] [Email] [Diff1] [Diff2] [Nits]
Versions: 00 01 02 03 04 05 RFC 2659
E. Rescorla, A. Schiffman
INTERNET-DRAFT Terisa Systems, Inc.
<draft-ietf-wts-shtml-05.txt> June 1998 (Expires December-98)
Security Extensions For HTML
Status of this Memo
This document is an Internet-Draft. Internet-Drafts are working
documents of the Internet Engineering Task Force (IETF), its areas,
and its working groups. Note that other groups may also distribute
working documents as Internet-Drafts.
Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as ``work in progress.''
To view the entire list of current Internet-Drafts, please check
the "1id-abstracts.txt" listing contained in the Internet-Drafts
Shadow Directories on ftp.is.co.za (Africa), ftp.nordu.net
(Northern Europe), ftp.nis.garr.it (Southern Europe), munnari.oz.au
(Pacific Rim), ftp.ietf.org (US East Coast), or ftp.isi.edu
(US West Coast).
This document was originally part of [SHTTP] but has been broken out
to reflect it's independence from the protocol aspects of S-HTTP.
Abstract
This memo describes a syntax for embedding S-HTTP negotiation parame-
ters in HTML documents. S-HTTP as described by draft-ietf-wts-shttp-
03.txt contains the concept of negotation headers which reflect the
potential receiver of a message's preferences as to which crypto-
graphic enhancements should be applied to the message. This document
describes a syntax for binding these negotiation parameters to HTML
anchors.
1. Introduction
2. Anchor Attributes
We define the following new anchor (and form submission) attributes:
DN -- The distinguished name of the principal for whom the
request should be encrypted when dereferencing the anchor's
URL. This need not be specified, but failure to do so runs
the risk that the client will be unable to determine the DN
and therefore will be unable to encrypt. This should be
Rescorla, Schiffman [Page 1]Internet-Draft HTML Security Extensions
specified in the form of RFC1485, using SGML quoting con-
ventions as needed.
NONCE -- A free-format string (appropriately SGML quoted)
which is to be included in a SHTTP-Nonce: header (after
SGML quoting is removed) when the anchor is dereferenced.
CRYPTOPTS -- Cryptographic option information as described
in [SHTTP]. Specifically, the <cryptopt-list> production.
2.1. CERTS Element
A new CERTS HTML element is defined, which carries a (not necessarily
related) group of certificates provided as advisory data. The element
contents are not intended to be displayed to the user. Certificate
groups may be provided appropriate for either PEM or PKCS-7 implemen-
tations. Such certificates are supplied in the HTML document for the
convenience of the recipient, who might otherwise be unable to
retrieve the certificate (chain) corresponding to a DN specified in
an anchor.
The format should be the same as that of the 'Certificate-Info'
header line, of [SHTTP] except that the <Cert-Fmt> specifier should
be provided as the FMT attribute in the tag.
Multiple CERTS elements are permitted; it is suggested that CERTS
elements themselves be included in the HTML document's HEAD element
(in the hope that the data will not be displayed by S-HTTP oblivious
but HTML compliant browsers.)
2.2. CRYPTOPTS Element
Cryptopts may also be broken out into an element and referred to in
anchors by name. The NAME attribute specifies the name by which this
element may be referred to in a CRYPTOPTS attribute in an anchor.
Names must have a # as the leading character.
2.3. HTML Example
An example of cryptographic data embedded in an anchor, proceeded by
a certificate group is provided below. Note the SGML quoting syntax
used to supply embedded quotation marks.
Rescorla, Schiffman [Page 2]Internet-Draft HTML Security Extensions
<CERTS FMT=PKCS-7>
MIAGCSqGSIb3DQEHAqCAMIACAQExADCABgkqhkiG9w0BBwEAAKCAM
IIBrTCCAUkCAgC2MA0GCSqGSIb3DQEBAgUAME0xCzAJBgNVBAYTAlVTMSAwH
gYDVQQKExdSU0EgRGF0YSBTZWN1cml0eSwgSW5jLjEcMBoGA1UECxMTUGVyc
29uYSBDZXJ0aWZpY2F0ZTAeFw05NDA0MDkwMDUwMzdaFw05NDA4MDIxODM4N
TdaMGcxCzAJBgNVBAYTAlVTMSAwHgYDVQQKExdSU0EgRGF0YSBTZWN1cml0e
SwgSW5jLjEcMBoGA1UECxMTUGVyc29uYSBDZXJ0aWZpY2F0ZTEYMBYGA1UEA
xMPU2V0ZWMgQXN0cm9ub215MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAMy8Q
cW7RMrB4sTdQ8Nmb2DFmJmkWn+el+NdeamIDElX/qw9mIQu4xNj1FfepfJNx
zPvA0OtMKhy6+bkrlyMEU8CAwEAATANBgkqhkiG9w0BAQIFAANPAAYn7jDgi
rhiIL4wnP8nGzUisGSpsFsF4/7z2P2wqne6Qk8Cg/Dstu3RyaN78vAMGP8d8
2H5+Ndfhi2mRp4YHiGHz0HlK6VbPfnyvS2wdjCCAccwggFRAgUCQAAAFDANB
gkqhkiG9w0BAQIFADBfMQswCQYDVQQGEwJVUzEgMB4GA1UEChMXUlNBIERhd
GEgU2VjdXJpdHksIEluYy4xLjAsBgNVBAsTJUxvdyBBc3N1cmFuY2UgQ2Vyd
GlmaWNhdGlvbiBBdXRob3JpdHkwHhcNOTQwMTA3MDAwMDAwWhcNOTYwMTA3M
jM1OTU5WjBNMQswCQYDVQQGEwJVUzEgMB4GA1UEChMXUlNBIERhdGEgU2Vjd
XJpdHksIEluYy4xHDAaBgNVBAsTE1BlcnNvbmEgQ2VydGlmaWNhdGUwaTANB
gkqhkiG9w0BAQEFAANYADBVAk4GqghQDa9Xi/2zAdYEqJVIcYhlLN1FpI9tX
Q1m6zZ39PYXK8Uhoj0Es7kWRv8hC04vqkOKwndWbzVtvoHQOmP8nOkkuBi+A
QvgFoRcgOUCAwEAATANBgkqhkiG9w0BAQIFAANhAD/5Uo7xDdp49oZm9GoNc
PhZcW1e+nojLvHXWAU/CBkwfcR+FSf4hQ5eFu1AjYv6Wqf430Xe9Et5+jgnM
Tiq4LnwgTdA8xQX4elJz9QzQobkE3XVOjVAtCFcmiin80RB8AAAMYAAAAAAA
AAAAA==
</CERTS>
<A name=foobar
DN="CN=Setec Astronomy, OU=Persona Certificate,
O="RSA Data Security, Inc.", C=US"
CRYPTOPTS="SHTTP-Privacy-Enhancements: recv-refused=encrypt;
SHTTP-Signature-Algorithms: recv-required=NIST-DSS"
HREF="shttp://research.nsa.gov/skipjack-holes.html">
Don't read this. </A>
Rescorla, Schiffman [Page 3]Internet-Draft HTML Security Extensions
References
[SHTTP] Rescorla, E., Schiffman, A.M., "The Secure HyperText Transfer
Protocol", draft-ietf-wts-shttp-06.txt, June 98.
Security Considerations
This entire document is about security.
Authors' Address
Eric Rescorla <ekr@terisa.com>
Terisa Systems, Inc.
4984 El Camino Real
Los Altos, CA 94022
Phone: (415) 919-1753
Allan M. Schiffman <ams@terisa.com>
Terisa Systems, Inc.
4984 El Camino Real
Los Altos, CA 94022
Phone: (415) 919-1755
Html markup produced by rfcmarkup 1.129b, available from
https://tools.ietf.org/tools/rfcmarkup/