Research inquiry: native Firefox support for RFC 9421 and RFC 9530

[Martin Tuhus]

Hello,

My name is Martin Tuhus, and I am preparing a scientific paper based on research conducted at the University of Oslo.

The paper examines web applications that use TLS-terminating intermediaries,
such as CDNs and WAFs. I developed and evaluated a prototype that uses HTTP
Message Signatures, Content-Digest, and selective field-level encryption to
protect communication beyond the TLS intermediary.

RFC 9421:
https://www.rfc-editor.org/rfc/rfc9421.html

RFC 9530:
https://www.rfc-editor.org/rfc/rfc9530.html

I am also aware of the Signature-based Integrity proposal, which applies a
profile of RFC 9421 to signed web resources:
https://github.com/WICG/signature-based-sri

My prototype currently relies on a Service Worker and an out-of-band verifier.
I am investigating whether the relevant functionality could instead be
integrated into browsers. In such a model, the browser could verify signed
responses before exposing them to the page, generate an origin-bound key for
signing selected requests, and retrieve the origin's verification key through
a trusted mechanism.

I would greatly appreciate your perspective on three questions:

 1. Is work involving RFC 9421 or RFC 9530 currently being considered in
   Firefox, beyond the Signature-based Integrity use case?

 2. Would native verification of signed origin responses and signing of
   selected outgoing requests be compatible with the browser's networking
   and security architecture?

 3. When implementing HTTP Message Signatures the browser needs a public key to check    the signatures. Do you have any thoughts on how the public key could securely be sent from the web application to the browser?

Even a response of a few sentences would be highly valuable. With your
permission, I may quote or summarise the response in the paper. Please indicate
whether your response represents a personal technical opinion, a team
perspective, or an official project position.

The relevant section will be finalised on 5 August 2026, so a response before
that date would be greatly appreciated.

Best regards,

Martin Tuhus
University of Oslo
Martin...@gmail.com

[Lars Eggert]

CC necko

> --
> You received this message because you are subscribed to the Google Groups "dev-pl...@mozilla.org" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to dev-platform...@mozilla.org.
> To view this discussion visit https://groups.google.com/a/mozilla.org/d/msgid/dev-platform/fd429fd9-355e-48ab-9112-126deacba1e4n%40mozilla.org.

[Tom Schuster]

Hi Martin!

We are actively looking at a related project called Web Application Integrity, Consistency and Transparency (WAICT). I would recommend you check it out.

https://waict.dev/

Best,

Tom

> To unsubscribe from this group and stop receiving emails from it, send an email to dev-platform+unsubscribe@mozilla.org.