E. Rescorla, A. Schiffman
INTERNET-DRAFT                        Enterprise Integration Technologies
<draft-ietf-wts-shtml-00.txt>                Feb 1996 (Expires August-96)

                      Security Extensions For HTML

Status of this Memo

   This document is an Internet-Draft.  Internet-Drafts are working
   documents of the Internet Engineering Task Force (IETF), its areas,
   and its working groups.  Note that other groups may also distribute
   working documents as Internet-Drafts.

   Internet-Drafts are draft documents valid for a maximum of six months
   and may be updated, replaced, or obsoleted by other documents at any
   time.  It is inappropriate to use Internet-Drafts as reference
   material or to cite them other than as ``work in progress.''

   To learn the current status of any Internet-Draft, please check the
   ``1id-abstracts.txt'' listing contained in the Internet-Drafts Shadow
   Directories on ftp.is.co.za (Africa), nic.nordu.net (Europe),
   munnari.oz.au (Pacific Rim), ds.internic.net (US East Coast), or
   ftp.isi.edu (US West Coast).

   This document was originally part of [SHTTP] but has been broken out
   to reflect it's independence from the protocol aspects of S-HTTP.


   This memo describes a syntax for embedding S-HTTP negotiation parame-
   ters in HTML documents. S-HTTP as described by draft-ietf-wts-shttp-
   01.txt contains the concept of negotation headers which reflect the
   potential receiver of a message's preferences as to which crypto-
   graphic enhancements should be applied to the message. This document
   describes a syntax for binding these negotiation parameters to HTML

   1.  Introduction

   2.  Anchor Attributes

   We define the following new anchor (and form submission) attributes:

        DN -- The distinguished name of the principal for whom the
        request should be encrypted when dereferencing the anchor's
        URL.  This need not be specified, but failure to do so runs
        the risk that the client will be unable to determine the DN
        and therefore will be unable to encrypt. This should be

Rescorla, Schiffman                                              [Page 1]Internet-Draft          HTML Security Extensions

        specified in the form of RFC1485, using SGML quoting con-
        ventions as needed.

        NONCE -- A free-format string (appropriately SGML quoted)
        which is to be included in a SHTTP-Nonce: header (after
        SGML quoting is removed) when the anchor is dereferenced.

        CRYPTOPTS -- Cryptographic option information as described
        in [SHTTP]. If multiline, this must be quoted to protect
        the line break information.

2.1.  CERTS Element

   A new CERTS HTML element is defined, which carries a (not necessarily
   related) group of certificates provided as advisory data. The element
   contents are not intended to be displayed to the user. Certificate
   groups may be provided appropriate for either PEM or PKCS-7 implemen-
   tations. Such certificates are supplied in the HTML document for the
   convenience of the recipient, who might otherwise be unable to
   retrieve the certificate (chain) corresponding to a DN specified in
   an anchor.

   The format should be the same as that of the 'Certificate-Info'
   header line, of [SHTTP] except that the <Cert-Fmt> specifier should
   be provided as the FMT attribute in the tag.

   Multiple CERTS elements are permitted; it is suggested that CERTS
   elements themselves be included in the HTML document's HEAD element
   (in the hope that the data will not be displayed by S-HTTP oblivious
   but HTML compliant browsers.

2.2.  CRYPTOPTS Element

   Cryptopts may also be broken out into an element and referred to in
   anchors by name. The NAME attribute specifies the name by which this
   element may be referred to in a CRYPTOPTS attribute in an anchor.
   Names must have a # as the leading character.

2.3.  HTML Example

   An example of cryptographic data embedded in an anchor, proceeded by
   a certificate group is provided below. Note the SGML quoting syntax
   used to supply embedded quotation marks.

Rescorla, Schiffman                                              [Page 2]Internet-Draft          HTML Security Extensions

           <CERTS FMT=PKCS-7>
           <A name=foobar
           DN="CN=Setec Astronomy, OU=Persona Certificate,
               O=&quot;RSA Data Security, Inc.&quot;, C=US"
           CRYPTOPTS="SHTTP-Privacy-Enhancements: recv-refused=encrypt
           SHTTP-Signature-Algorithms: recv-required=NIST-DSS"
           Don't read this. </A>

Rescorla, Schiffman                                              [Page 3]Internet-Draft          HTML Security Extensions

   [SHTTP] Rescorla, E., Schiffman, A.M., "The Secure HyperText Transfer
       Protocol", draft-ietf-wts-shttp-01.txt, Feb 1996.

Security Considerations

   This entire document is about security.