[html5] r7012 - [giow] (0) Add a spec for http+aes:// and https+aes:// to allow sensitive resour [...]
whatwg at whatwg.org
whatwg at whatwg.org
Fri Mar 2 15:24:33 PST 2012
Author: ianh
Date: 2012-03-02 15:24:32 -0800 (Fri, 02 Mar 2012)
New Revision: 7012
Modified:
complete.html
index
source
Log:
[giow] (0) Add a spec for http+aes:// and https+aes:// to allow sensitive resources to be held on untrusted servers.
Affected topics: HTML, Security
Modified: complete.html
===================================================================
--- complete.html 2012-02-29 23:39:27 UTC (rev 7011)
+++ complete.html 2012-03-02 23:24:32 UTC (rev 7012)
@@ -240,7 +240,7 @@
<header class=head id=head><p><a class=logo href=http://www.whatwg.org/><img alt=WHATWG height=101 src=/images/logo width=101></a></p>
<hgroup><h1 class=allcaps>HTML</h1>
- <h2 class="no-num no-toc">Living Standard — Last Updated 29 February 2012</h2>
+ <h2 class="no-num no-toc">Living Standard — Last Updated 2 March 2012</h2>
</hgroup><dl><dt><strong>Web developer edition:</strong></dt>
<dd><strong><a href=http://developers.whatwg.org/>http://developers.whatwg.org/</a></strong></dd>
<dt>Multiple-page version:</dt>
@@ -1323,7 +1323,9 @@
<li><a href=#application/microdata+json><span class=secno>16.7 </span><code>application/microdata+json</code></a></li>
<li><a href=#ping-from><span class=secno>16.8 </span><code>Ping-From</code></a></li>
<li><a href=#ping-to><span class=secno>16.9 </span><code>Ping-To</code></a></li>
- <li><a href=#web+-scheme-prefix><span class=secno>16.10 </span><code>web+</code> scheme prefix</a></ol></li>
+ <li><a href=#http+aes-scheme><span class=secno>16.10 </span><code>http+aes</code> scheme</a></li>
+ <li><a href=#https+aes-scheme><span class=secno>16.11 </span><code>https+aes</code> scheme</a></li>
+ <li><a href=#web+-scheme-prefix><span class=secno>16.12 </span><code>web+</code> scheme prefix</a></ol></li>
<li><a class=no-num href=#index>Index</a>
<ol>
<li><a class=no-num href=#elements-1>Elements</a></li>
@@ -94738,8 +94740,128 @@
</dd>
<dt>Related information:</dt>
<dd>None.</dd>
- </dl><!--PING--><h3 id=web+-scheme-prefix><span class=secno>16.10 </span><dfn title=scheme-web><code>web+</code> scheme prefix</dfn></h3>
+ </dl><!--PING--><h3 id=http+aes-scheme><span class=secno>16.10 </span><dfn title=scheme-http+aes><code>http+aes</code> scheme</dfn></h3>
+ <p>This section describes a URL scheme registration for the IANA URI
+ scheme registry. <a href=#refsRFC4395>[RFC4395]</a></p>
+
+ <dl><dt>URI scheme name:</dt>
+ <dd><code title="">http+aes</code></dd>
+ <dt>Status:</dt>
+ <dd>permanent</dd>
+ <dt>URI scheme syntax:</dt>
+ <dd>Same as <code title="">http</code>, with the <code title="">userinfo</code> component instead used for specifying the
+ decryption key. (This key is provided in the form of 16, 24, or 32
+ bytes encoded as ASCII and escaped as necessary using the URL
+ escape mechanism; it is not in the "username:password" form, and
+ the ":" character is not special in this component when using this
+ scheme.)</dd>
+ <dt>URI scheme semantics:</dt>
+ <dd>Same as <code title="">http</code>, except that the message
+ body must be decrypted by applying the AES-CTR algorithm using the
+ key specified in the URL's <code title="">userinfo</code>
+ component, after unescaping it from the URL syntax to bytes. If
+ there is no such component, or if that component, when unescaped
+ from the URL syntax to bytes, does not consist of exactly 16, 24,
+ or 32 bytes, then the user agent must act as if the resource could
+ not be obtained due to a network error, and may report the problem
+ to the user.</dd>
+ <dt>Encoding considerations:</dt>
+ <dd>Same as <code title="">http</code>, but the <code title="">userinfo</code> component represents bytes encoded using
+ ASCII and the URL escape mechanism.</dd>
+ <dt>Applications/protocols that use this URI scheme name:</dt>
+ <dd>Same as <code title="">http</code>.</dd>
+ <dt>Interoperability considerations:</dt>
+ <dd>Same as <code title="">http</code>, but specifically for
+ private resources that are hosted by untrusted intermediary servers
+ as in a content delivery network.</dd>
+<!--ADD-TOPIC:Security-->
+ <dt>Security considerations:</dt>
+ <dd>
+ <p>URLs using this scheme contain sensitive information (the key
+ used to decrypt the referenced content) and as such should be
+ handled with care, e.g. only sent over TLS-encrypted connections,
+ and only sent to users who are authorized to access the encrypted
+ content.</p>
+ <p>User agents are encouraged to not show the key in user
+ interface elements where the URL is displayed: first, it's ugly
+ and not useful to the user; and second, it could be used to
+ obscure the domain name.</p>
+ <p>The <code title="">http+aes</code> URL scheme only enables the
+ <em>content</em> of a particular resource to be encrypted. Any
+ sensitive information held in HTTP headers is still transmitted in
+ the clear. The length of the resource is still visible. The rate
+ at which the data is transmitted is also unobscured. The name of
+ the resource is not hidden. If this scheme is used to obscure
+ private information, it is important to consider how these side
+ channels might leak information.</p>
+ <p class=example>For example, the length of a file containing
+ only the user's age in seconds encoded in ASCII would easily let
+ an attacker watching the network traffic or with access to the
+ system hosting the files determine if the user was less than 3
+ years old, less than 30 years old, or more than 30 years old, just
+ from the length of the file. Padding the file to ten digits
+ (either with trailing spaces or leading zeros) would make all ages
+ from zero to three hundred indistinguishable.</p>
+ <p class=example>Another example would be the file name.
+ Consider a bank where each user first downloads a "data.json"
+ file, which points to some other files for more data, such that
+ users in debt download a "debt.json" file while users in credit
+ download a "credit.json" file. In such a scenario, users can be
+ categorised by an attacker watching network traffic or with access
+ to the system hosting the files without the attacker ever having
+ to decrypt the "data.json" files.</p>
+ <p>The security considerations that apply to <code title="">http</code> apply as well.</p>
+ </dd>
+<!--REMOVE-TOPIC:Security-->
+ <dt>Contact:</dt>
+ <dd>Ian Hickson <ian at hixie.ch></dd>
+ <dt>Author/Change controller:</dt>
+ <dd>Ian Hickson <ian at hixie.ch></dd>
+ <dt>References:</dt>
+ <dd>
+ The <code title="">http</code> URL scheme is defined in:
+ <a href=http://tools.ietf.org/html/draft-ietf-httpbis-p1-messaging>http://tools.ietf.org/html/draft-ietf-httpbis-p1-messaging</a>
+ </dd>
+ </dl><h3 id=https+aes-scheme><span class=secno>16.11 </span><dfn title=scheme-https+aes><code>https+aes</code> scheme</dfn></h3>
+
+ <p>This section describes a URL scheme registration for the IANA URI
+ scheme registry. <a href=#refsRFC4395>[RFC4395]</a></p>
+
+ <dl><dt>URI scheme name:</dt>
+ <dd><code title="">https+aes</code></dd>
+ <dt>Status:</dt>
+ <dd>permanent</dd>
+ <dt>URI scheme syntax:</dt>
+ <dd>Same as <code title="">http+aes</code>.</dd>
+ <dt>URI scheme semantics:</dt>
+ <dd>Same as <code title="">http+aes</code>.</dd>
+ <dt>Encoding considerations:</dt>
+ <dd>Same as <code title="">http+aes</code>.</dd>
+ <dt>Applications/protocols that use this URI scheme name:</dt>
+ <dd>Same as <code title="">https</code>.</dd>
+ <dt>Interoperability considerations:</dt>
+ <dd>Same as <code title="">https</code>, but specifically for
+ private resources that are hosted by untrusted intermediary servers
+ as in a content delivery network.</dd>
+<!--ADD-TOPIC:Security-->
+ <dt>Security considerations:</dt>
+ <dd>
+ <p>The security considerations that apply to <code title="">http+aes</code> and <code title="">https</code> apply as
+ well.</p>
+ </dd>
+<!--REMOVE-TOPIC:Security-->
+ <dt>Contact:</dt>
+ <dd>Ian Hickson <ian at hixie.ch></dd>
+ <dt>Author/Change controller:</dt>
+ <dd>Ian Hickson <ian at hixie.ch></dd>
+ <dt>References:</dt>
+ <dd>
+ The <code title="">https</code> URL scheme is defined in:
+ <a href=http://tools.ietf.org/html/draft-ietf-httpbis-p1-messaging>http://tools.ietf.org/html/draft-ietf-httpbis-p1-messaging</a>
+ </dd>
+ </dl><h3 id=web+-scheme-prefix><span class=secno>16.12 </span><dfn title=scheme-web><code>web+</code> scheme prefix</dfn></h3>
+
<p>This section describes a convention for use with the IANA URI
scheme registry. It does not itself register a specific scheme. <a href=#refsRFC4395>[RFC4395]</a></p>
Modified: index
===================================================================
--- index 2012-02-29 23:39:27 UTC (rev 7011)
+++ index 2012-03-02 23:24:32 UTC (rev 7012)
@@ -240,7 +240,7 @@
<header class=head id=head><p><a class=logo href=http://www.whatwg.org/><img alt=WHATWG height=101 src=/images/logo width=101></a></p>
<hgroup><h1 class=allcaps>HTML</h1>
- <h2 class="no-num no-toc">Living Standard — Last Updated 29 February 2012</h2>
+ <h2 class="no-num no-toc">Living Standard — Last Updated 2 March 2012</h2>
</hgroup><dl><dt><strong>Web developer edition:</strong></dt>
<dd><strong><a href=http://developers.whatwg.org/>http://developers.whatwg.org/</a></strong></dd>
<dt>Multiple-page version:</dt>
@@ -1323,7 +1323,9 @@
<li><a href=#application/microdata+json><span class=secno>16.7 </span><code>application/microdata+json</code></a></li>
<li><a href=#ping-from><span class=secno>16.8 </span><code>Ping-From</code></a></li>
<li><a href=#ping-to><span class=secno>16.9 </span><code>Ping-To</code></a></li>
- <li><a href=#web+-scheme-prefix><span class=secno>16.10 </span><code>web+</code> scheme prefix</a></ol></li>
+ <li><a href=#http+aes-scheme><span class=secno>16.10 </span><code>http+aes</code> scheme</a></li>
+ <li><a href=#https+aes-scheme><span class=secno>16.11 </span><code>https+aes</code> scheme</a></li>
+ <li><a href=#web+-scheme-prefix><span class=secno>16.12 </span><code>web+</code> scheme prefix</a></ol></li>
<li><a class=no-num href=#index>Index</a>
<ol>
<li><a class=no-num href=#elements-1>Elements</a></li>
@@ -94738,8 +94740,128 @@
</dd>
<dt>Related information:</dt>
<dd>None.</dd>
- </dl><!--PING--><h3 id=web+-scheme-prefix><span class=secno>16.10 </span><dfn title=scheme-web><code>web+</code> scheme prefix</dfn></h3>
+ </dl><!--PING--><h3 id=http+aes-scheme><span class=secno>16.10 </span><dfn title=scheme-http+aes><code>http+aes</code> scheme</dfn></h3>
+ <p>This section describes a URL scheme registration for the IANA URI
+ scheme registry. <a href=#refsRFC4395>[RFC4395]</a></p>
+
+ <dl><dt>URI scheme name:</dt>
+ <dd><code title="">http+aes</code></dd>
+ <dt>Status:</dt>
+ <dd>permanent</dd>
+ <dt>URI scheme syntax:</dt>
+ <dd>Same as <code title="">http</code>, with the <code title="">userinfo</code> component instead used for specifying the
+ decryption key. (This key is provided in the form of 16, 24, or 32
+ bytes encoded as ASCII and escaped as necessary using the URL
+ escape mechanism; it is not in the "username:password" form, and
+ the ":" character is not special in this component when using this
+ scheme.)</dd>
+ <dt>URI scheme semantics:</dt>
+ <dd>Same as <code title="">http</code>, except that the message
+ body must be decrypted by applying the AES-CTR algorithm using the
+ key specified in the URL's <code title="">userinfo</code>
+ component, after unescaping it from the URL syntax to bytes. If
+ there is no such component, or if that component, when unescaped
+ from the URL syntax to bytes, does not consist of exactly 16, 24,
+ or 32 bytes, then the user agent must act as if the resource could
+ not be obtained due to a network error, and may report the problem
+ to the user.</dd>
+ <dt>Encoding considerations:</dt>
+ <dd>Same as <code title="">http</code>, but the <code title="">userinfo</code> component represents bytes encoded using
+ ASCII and the URL escape mechanism.</dd>
+ <dt>Applications/protocols that use this URI scheme name:</dt>
+ <dd>Same as <code title="">http</code>.</dd>
+ <dt>Interoperability considerations:</dt>
+ <dd>Same as <code title="">http</code>, but specifically for
+ private resources that are hosted by untrusted intermediary servers
+ as in a content delivery network.</dd>
+<!--ADD-TOPIC:Security-->
+ <dt>Security considerations:</dt>
+ <dd>
+ <p>URLs using this scheme contain sensitive information (the key
+ used to decrypt the referenced content) and as such should be
+ handled with care, e.g. only sent over TLS-encrypted connections,
+ and only sent to users who are authorized to access the encrypted
+ content.</p>
+ <p>User agents are encouraged to not show the key in user
+ interface elements where the URL is displayed: first, it's ugly
+ and not useful to the user; and second, it could be used to
+ obscure the domain name.</p>
+ <p>The <code title="">http+aes</code> URL scheme only enables the
+ <em>content</em> of a particular resource to be encrypted. Any
+ sensitive information held in HTTP headers is still transmitted in
+ the clear. The length of the resource is still visible. The rate
+ at which the data is transmitted is also unobscured. The name of
+ the resource is not hidden. If this scheme is used to obscure
+ private information, it is important to consider how these side
+ channels might leak information.</p>
+ <p class=example>For example, the length of a file containing
+ only the user's age in seconds encoded in ASCII would easily let
+ an attacker watching the network traffic or with access to the
+ system hosting the files determine if the user was less than 3
+ years old, less than 30 years old, or more than 30 years old, just
+ from the length of the file. Padding the file to ten digits
+ (either with trailing spaces or leading zeros) would make all ages
+ from zero to three hundred indistinguishable.</p>
+ <p class=example>Another example would be the file name.
+ Consider a bank where each user first downloads a "data.json"
+ file, which points to some other files for more data, such that
+ users in debt download a "debt.json" file while users in credit
+ download a "credit.json" file. In such a scenario, users can be
+ categorised by an attacker watching network traffic or with access
+ to the system hosting the files without the attacker ever having
+ to decrypt the "data.json" files.</p>
+ <p>The security considerations that apply to <code title="">http</code> apply as well.</p>
+ </dd>
+<!--REMOVE-TOPIC:Security-->
+ <dt>Contact:</dt>
+ <dd>Ian Hickson <ian at hixie.ch></dd>
+ <dt>Author/Change controller:</dt>
+ <dd>Ian Hickson <ian at hixie.ch></dd>
+ <dt>References:</dt>
+ <dd>
+ The <code title="">http</code> URL scheme is defined in:
+ <a href=http://tools.ietf.org/html/draft-ietf-httpbis-p1-messaging>http://tools.ietf.org/html/draft-ietf-httpbis-p1-messaging</a>
+ </dd>
+ </dl><h3 id=https+aes-scheme><span class=secno>16.11 </span><dfn title=scheme-https+aes><code>https+aes</code> scheme</dfn></h3>
+
+ <p>This section describes a URL scheme registration for the IANA URI
+ scheme registry. <a href=#refsRFC4395>[RFC4395]</a></p>
+
+ <dl><dt>URI scheme name:</dt>
+ <dd><code title="">https+aes</code></dd>
+ <dt>Status:</dt>
+ <dd>permanent</dd>
+ <dt>URI scheme syntax:</dt>
+ <dd>Same as <code title="">http+aes</code>.</dd>
+ <dt>URI scheme semantics:</dt>
+ <dd>Same as <code title="">http+aes</code>.</dd>
+ <dt>Encoding considerations:</dt>
+ <dd>Same as <code title="">http+aes</code>.</dd>
+ <dt>Applications/protocols that use this URI scheme name:</dt>
+ <dd>Same as <code title="">https</code>.</dd>
+ <dt>Interoperability considerations:</dt>
+ <dd>Same as <code title="">https</code>, but specifically for
+ private resources that are hosted by untrusted intermediary servers
+ as in a content delivery network.</dd>
+<!--ADD-TOPIC:Security-->
+ <dt>Security considerations:</dt>
+ <dd>
+ <p>The security considerations that apply to <code title="">http+aes</code> and <code title="">https</code> apply as
+ well.</p>
+ </dd>
+<!--REMOVE-TOPIC:Security-->
+ <dt>Contact:</dt>
+ <dd>Ian Hickson <ian at hixie.ch></dd>
+ <dt>Author/Change controller:</dt>
+ <dd>Ian Hickson <ian at hixie.ch></dd>
+ <dt>References:</dt>
+ <dd>
+ The <code title="">https</code> URL scheme is defined in:
+ <a href=http://tools.ietf.org/html/draft-ietf-httpbis-p1-messaging>http://tools.ietf.org/html/draft-ietf-httpbis-p1-messaging</a>
+ </dd>
+ </dl><h3 id=web+-scheme-prefix><span class=secno>16.12 </span><dfn title=scheme-web><code>web+</code> scheme prefix</dfn></h3>
+
<p>This section describes a convention for use with the IANA URI
scheme registry. It does not itself register a specific scheme. <a href=#refsRFC4395>[RFC4395]</a></p>
Modified: source
===================================================================
--- source 2012-02-29 23:39:27 UTC (rev 7011)
+++ source 2012-03-02 23:24:32 UTC (rev 7012)
@@ -110610,6 +110610,139 @@
<!--START w3c-html--><!--PING-->
+ <h3><dfn title="scheme-http+aes"><code>http+aes</code> scheme</dfn></h3>
+
+ <p>This section describes a URL scheme registration for the IANA URI
+ scheme registry. <a href="#refsRFC4395">[RFC4395]</a></p>
+
+ <dl>
+ <dt>URI scheme name:</dt>
+ <dd><code title="">http+aes</code></dd>
+ <dt>Status:</dt>
+ <dd>permanent</dd>
+ <dt>URI scheme syntax:</dt>
+ <dd>Same as <code title="">http</code>, with the <code
+ title="">userinfo</code> component instead used for specifying the
+ decryption key. (This key is provided in the form of 16, 24, or 32
+ bytes encoded as ASCII and escaped as necessary using the URL
+ escape mechanism; it is not in the "username:password" form, and
+ the ":" character is not special in this component when using this
+ scheme.)</dd>
+ <dt>URI scheme semantics:</dt>
+ <dd>Same as <code title="">http</code>, except that the message
+ body must be decrypted by applying the AES-CTR algorithm using the
+ key specified in the URL's <code title="">userinfo</code>
+ component, after unescaping it from the URL syntax to bytes. If
+ there is no such component, or if that component, when unescaped
+ from the URL syntax to bytes, does not consist of exactly 16, 24,
+ or 32 bytes, then the user agent must act as if the resource could
+ not be obtained due to a network error, and may report the problem
+ to the user.</dd>
+ <dt>Encoding considerations:</dt>
+ <dd>Same as <code title="">http</code>, but the <code
+ title="">userinfo</code> component represents bytes encoded using
+ ASCII and the URL escape mechanism.</dd>
+ <dt>Applications/protocols that use this URI scheme name:</dt>
+ <dd>Same as <code title="">http</code>.</dd>
+ <dt>Interoperability considerations:</dt>
+ <dd>Same as <code title="">http</code>, but specifically for
+ private resources that are hosted by untrusted intermediary servers
+ as in a content delivery network.</dd>
+<!--ADD-TOPIC:Security-->
+ <dt>Security considerations:</dt>
+ <dd>
+ <p>URLs using this scheme contain sensitive information (the key
+ used to decrypt the referenced content) and as such should be
+ handled with care, e.g. only sent over TLS-encrypted connections,
+ and only sent to users who are authorized to access the encrypted
+ content.</p>
+ <p>User agents are encouraged to not show the key in user
+ interface elements where the URL is displayed: first, it's ugly
+ and not useful to the user; and second, it could be used to
+ obscure the domain name.</p>
+ <p>The <code title="">http+aes</code> URL scheme only enables the
+ <em>content</em> of a particular resource to be encrypted. Any
+ sensitive information held in HTTP headers is still transmitted in
+ the clear. The length of the resource is still visible. The rate
+ at which the data is transmitted is also unobscured. The name of
+ the resource is not hidden. If this scheme is used to obscure
+ private information, it is important to consider how these side
+ channels might leak information.</p>
+ <p class="example">For example, the length of a file containing
+ only the user's age in seconds encoded in ASCII would easily let
+ an attacker watching the network traffic or with access to the
+ system hosting the files determine if the user was less than 3
+ years old, less than 30 years old, or more than 30 years old, just
+ from the length of the file. Padding the file to ten digits
+ (either with trailing spaces or leading zeros) would make all ages
+ from zero to three hundred indistinguishable.</p>
+ <p class="example">Another example would be the file name.
+ Consider a bank where each user first downloads a "data.json"
+ file, which points to some other files for more data, such that
+ users in debt download a "debt.json" file while users in credit
+ download a "credit.json" file. In such a scenario, users can be
+ categorised by an attacker watching network traffic or with access
+ to the system hosting the files without the attacker ever having
+ to decrypt the "data.json" files.</p>
+ <p>The security considerations that apply to <code
+ title="">http</code> apply as well.</p>
+ </dd>
+<!--REMOVE-TOPIC:Security-->
+ <dt>Contact:</dt>
+ <dd>Ian Hickson <ian at hixie.ch></dd>
+ <dt>Author/Change controller:</dt>
+ <dd>Ian Hickson <ian at hixie.ch></dd>
+ <dt>References:</dt>
+ <dd>
+ The <code title="">http</code> URL scheme is defined in:
+ <a href="http://tools.ietf.org/html/draft-ietf-httpbis-p1-messaging">http://tools.ietf.org/html/draft-ietf-httpbis-p1-messaging</a>
+ </dd>
+ </dl>
+
+
+ <h3><dfn title="scheme-https+aes"><code>https+aes</code> scheme</dfn></h3>
+
+ <p>This section describes a URL scheme registration for the IANA URI
+ scheme registry. <a href="#refsRFC4395">[RFC4395]</a></p>
+
+ <dl>
+ <dt>URI scheme name:</dt>
+ <dd><code title="">https+aes</code></dd>
+ <dt>Status:</dt>
+ <dd>permanent</dd>
+ <dt>URI scheme syntax:</dt>
+ <dd>Same as <code title="">http+aes</code>.</dd>
+ <dt>URI scheme semantics:</dt>
+ <dd>Same as <code title="">http+aes</code>.</dd>
+ <dt>Encoding considerations:</dt>
+ <dd>Same as <code title="">http+aes</code>.</dd>
+ <dt>Applications/protocols that use this URI scheme name:</dt>
+ <dd>Same as <code title="">https</code>.</dd>
+ <dt>Interoperability considerations:</dt>
+ <dd>Same as <code title="">https</code>, but specifically for
+ private resources that are hosted by untrusted intermediary servers
+ as in a content delivery network.</dd>
+<!--ADD-TOPIC:Security-->
+ <dt>Security considerations:</dt>
+ <dd>
+ <p>The security considerations that apply to <code
+ title="">http+aes</code> and <code title="">https</code> apply as
+ well.</p>
+ </dd>
+<!--REMOVE-TOPIC:Security-->
+ <dt>Contact:</dt>
+ <dd>Ian Hickson <ian at hixie.ch></dd>
+ <dt>Author/Change controller:</dt>
+ <dd>Ian Hickson <ian at hixie.ch></dd>
+ <dt>References:</dt>
+ <dd>
+ The <code title="">https</code> URL scheme is defined in:
+ <a href="http://tools.ietf.org/html/draft-ietf-httpbis-p1-messaging">http://tools.ietf.org/html/draft-ietf-httpbis-p1-messaging</a>
+ </dd>
+ </dl>
+
+
+
<h3><dfn title="scheme-web"><code>web+</code> scheme prefix</dfn></h3>
<p>This section describes a convention for use with the IANA URI
More information about the Commit-Watchers
mailing list