静态签署网页的标准方法
假设我的服务器上有一个有效的（即由普遍信任的权威机构之一签署的）加密证书。显然，我可以使用它来建立 https 会话，并以机密性（只有端点可以读取它们）、身份验证（两个端点都知道他们在与谁交谈）和可靠性（消息不能被篡改）来传递内容。
现在假设我实际上并不关心前两个，但我只需要最后一个。例如，假设我有一个静态资源，我想对其进行签名（a-la PGP），以便我可以将其提供给其他不受信任的主机：如果我的证书是公共的并且该资源已用它签名，则任何客户端都应该能够验证资源未被篡改（例如，被不受信任的主机篡改）。
现在的问题是：是否有一种标准方法对网页进行静态签名？ （我显然是指所有浏览器中内置的东西）我知道有人（Unhosted）正在尝试通过 Javascript 实现大部分逻辑来完成这样的事情，但我仍然想知道是否存在更标准的方法。
Suppose I have a valid (i.e. signed by one of the commonly trusted authorities) cryptographic certificate on my server. I could obviously use it to establish https sessions and deliver the contents with confidentiality (only the endpoints can read them), authentication (both endpoints know who they're talking to) and reliability (the message can't be tampered).
Now suppose that I actually don't care about the first two but, instead, I just the need the last one. For example, let's say I have a static resource that I would like to sign (a-la PGP) so that I can give it to other untrusted hosts: if my certificate is public and the resource has been signed with it, any client should be able to verify that the resource has not been tampered (e.g. by the untrusted host).
The question now is: is there a standard way to statically sign a web page? (I obviously mean something builtin in all browsers) I'm aware of someone (Unhosted) who's trying to accomplish something like this by implementing much of the logic via Javascript but still I'm wondering if a more standard way exists.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
我不知道浏览器中有任何这样的标准实现内置。
即使在邮件领域，这种行为长期以来都是“标准”的（S/MIME），我们每隔一天就会发现不同客户端、中继和服务器的问题。
对于下载，您可以恢复发送 PKCS#7 容器并关联解压和验证的工具。至少插件和帮助应用程序随处可见。
I'm not aware of any such standard implementation builtin in a browser.
Even in the mail area where such behavior is "standard" for long time (S/MIME), we find issues every other day with different clients, relays and servers.
For a download you may revert to sending a PKCS#7 container and associate a tool that unpacks and verifies. At least plugins and helper applications are availabel everywhere.
我也不知道浏览器中有任何类似的标准实现。但是，稍微备份一下...需要考虑一些事情：
对于可执行内容（如下载的 EXE 文件、ActiveX 控件、Windows Installer 等），一个常见/标准的解决方案是 Microsoft Authenticode。请参阅 http://www.tech-pro.net/code-signing- for-developers.html。针对 Java、Adobe 等的类似解决方案。您购买证书的 CA 将验证您的身份。当您使用来自受信任 CA 的证书签署 EXE 文件时，Internet Explorer 将显示签名者信息/不太可怕的警告消息。 Windows Vista/7 中的 UAC 提升提示也是如此。您可能对此很熟悉？
但对于静态内容的情况，标准解决方案是 SSL。请问为什么 SSL 在您的应用程序中不是可接受的解决方案？
我看到的问题是，除了单击浏览器中的 SSL“锁定”图标来查看证书之外，用户无法从网络浏览器验证网页的身份。新的 SSL EV 证书应验证您是否控制有问题的域，以及您的身份（即无法获得 www.paypal.com.hacker.cz 的“PayPal”证书）。
从你的问题来看，你正在寻找一种“网页验证码”之类的东西：一个证书，其主题不与域名绑定，并且网页可以去任何地方。不幸的是，我不知道标准 HTML 文件有任何这样的事情。我相信您可以签署 Adobe AIR 应用程序之类的东西，它可以基于 HTML / Javascript / 等，尽管我不熟悉该平台。当然，它确实将网页置于用户的普通网络浏览器之外。
I'm also not aware of any standard implementation like that within a browser. But, to back up a bit... some things to consider:
For executable content (like downloaded EXE files, ActiveX controls, Windows Installer, etc.), a common / standard solution is Microsoft Authenticode. See http://www.tech-pro.net/code-signing-for-developers.html. Similar solutions for Java, Adobe, etc. The CA you buy the cert from will verify your identity. When you sign an EXE file with a cert from a trusted CA, Internet Explorer will display the signer information / less scary warning message. Same goes for UAC elevation prompts in Windows Vista/7. You're probably familiar with this?
But for the static content situation, the standard solution is SSL. May I ask why SSL isn't an acceptable solution in your application?
The problem I see is that there's no way for the user to verify the identity of the web page from the web browser, other than clicking the SSL "lock" icon in the browser to view the certificate. The new SSL EV certificates should verify that you control the domain in question, and that you are who you say you are (i.e. not be able to get a "PayPal" certificate for www.paypal.com.hacker.cz).
It sounds from your question that you're looking for an "Authenticode for web pages" sort of thing: a certificate with a subject not tied to a domain name and where the web page could go anywhere. Unfortunately, I'm not aware of any such thing for standard HTML files. I believe you can sign things like Adobe AIR applications, which can be based on HTML / Javascript / etc., although I'm not familiar with that platform. It does place the web page outside of the user's normal web browser, of course.