[cap-talk] Handling SURL typed data, e.g. browser, Apache modules

[Jed at Webstart]

At 06:01 AM 12/12/2005, Sandro Magi wrote:
>Jed at Webstart wrote:
>>Yes.  Let me describe my thinking to see if it fits with the above.
>>Firstly let's assume that the server and client (client at a Web 
>>browser and Web server) both have public/private key pairs.  The 
>>server has access to the server-side private key (or at least an 
>>interface that can use it) and the client side similarly has access 
>>to the client's private key.  The public keys are available to both 
>>sides in any communication (the client has the servers public key 
>>and the server has the client's).
>>Then any time there's data sent from the server to the client (e.g. 
>>from a GET or POST), the server looks for any typed "SURL" in the 
>>data and translates it for the communication (e.g. as in the above 
>>paper with something like CdSuSu - where in this case C = Client 
>>and S = Server [not the capability server] and d=public and 
>>u=private) to the client.
>>Similarly when the client communicates to the server it uses 
>>something like SdCuCu to transform SURL typed data.  The way the 
>>scheme works, if anything goes through untranslated it becomes useless garbage.
>
>This is definitely more secure and flexible than my scheme. I was 
>thinking more short-term though, trying to achieve more or less this 
>protection without making changes to currently deployed software.

When you say changes to the deployed software, are you suggesting 
that doing something like the above would take more than an Apache 
module and a browser (e.g. Mozilla) plugin?

Of course I like to implement the closest to a "right" long term 
solution if I can imagine one if possible.

--Jed http://www.webstart.com/jed/