SSL and TLS suck badly at many things. Most of those things are to do with the reliance on X509 Certificates and Verisign. For a good rant check out Ian’s SSL considered harmful
Tyler Close has a great simple solution to this called HTTPSY, which I actually think lends it self more to web services than to web browsers.
It is a self authenticating scheme, where the url includes a sha1 hash of the signers public key. An example URL is this:
httpsy://+cl7h3f7jwyj3fvmw7jpnjfvf2xlcmayi@yurl.net/
The great thing is that you can use the security of TLS in your web applications, without having to purchase versign certificates all the time.
Ofcourse you could also hardcode your application to accept the certificate of a known server. But the httpsy approach makes it a lot more extendible.
To simplify developing for this. Tyler has helpfully created a drop in java url handler which should make client development simple.
Tyler has his own open source web server, which uses his very cool yet non standard API’s. This server supports httpsy out of the box if you follow these instructions.
As far as I can see you should be able to use any tls enabled web server such as tomcat, apache, orion etc. Follow the same general procedure as in Tyler’s instructions, just configure your server to use the generated transient key.
This entry was posted in the following Categories: Crypto & Security
Cool. The main benefit of this method is that you can implement your own key management, without disturbing your application. You could have different policies for different servers and clients.
Check out the source of this idea:
----------------------------------------------------
Separating key management from file system security.
David Mazi`eres, Michael Kaminsky, M. Frans Kaashoek, and Emmett Witchel
17th ACM Symposium on Operating Systems Principles (SOSP ’99)
http://citeseer.nj.nec.com/mazieres99separating.html
--------------------------------------------------
Hi Pelle,
Glad you found this useful. Thanks for saying so.
You're right, httpsy is primarily intended for use in web services, not web browsing. With support for Pet Names in the browser (see the Waterken Browser), httpsy works really well for browsing, but that's not what I built it for. I built it for use with the web-calculus, a web services framework. Of course, it's also useful with other web service frameworks.
All the web browser documentation is only there because as soon as people see http, they start asking about web browsing scenarios. The docs and essays exist to answer those questions.
You wrote:
"As far as I can see you should be able to use any tls enabled web server such as tomcat, apache, orion etc."
Unfortunately, this is not true. HTTPSY is designed to use the HTTP/1.1 connection Upgrade feature, instead of running HTTP over an already established TLS/1.0 connection.
One of the benefits of this design choice is that it's easy to run multiple HTTPSY virtual hosts on a single IP address. I want to give each web service its own public/private key identity, instead of lumping them all under the same key, as you do with https. This lets you make both the location and the security of each web service independent of the others. It also encourages making key pairs with a shorter lifetime. Each key pair can be terminated when its web service reaches its end-of-life, instead of being reused by subsequent web services.
For now, you'll just have to use the Waterken Server. If that gets you into the web-calculus, well wouldn't that be a coincidence. ;) I'd also be happy to see someone implement an Apache extension.
Tyler
Posted by: Tyler on January 22, 2004 12:54 AMFor the record, the inspiration for httpsy comes from the E language . I believe the use of YURLs in the E language predates SFS by many years.
Posted by: Tyler Close on January 22, 2004 08:58 PM