Subject: Re: http+aes

From: Jeroen van der Gun <[email-masked]>
Date: Thu, 08 Mar 2012 17:13:43 +0000

I think you are re-inventing the wheel. As far as I can tell, the
purpose of this HTTP+AES proposal is end-to-end encryption. This problem
has already been solved for e-mail and those solutions can easily be
extended to HTTP.

I'd propose to develop something like HTTP+S/MIME instead. The
advantages compared to the current proposal are:
* In addition to encryption, the file can be signed. This means that
HTTPS pages can include HTTP+AES content without creating a mixed
content problem.
* Headers like Content-Type are also encrypted and signed.
* A normal HTTP request for the encrypted resource will not result in
trying to render garbage.

---

From: Julian Reschke <[email-masked]>
Date: Mon, 12 Mar 2012 10:04:34 +0100

On 2012-03-08 18:13, Jeroen van der Gun wrote:
 > ...

"You" -> the author of the HTML spec.

I only forwarded the spec pointer to notify people abou what's going on 
in the HTML WG, and I really recommend to follow up on their mailing list.

 > ...

Best regards, Julian