![](bg9.png)
resources and the main page. To ensure the authen-
ticity of the DNS records, DNS-based Authentication
of Named Entities (DANE) is used. However, un-
like WEBAPPAUTH, SecureBrowse does not require
the key to be kept outside of the web server’s con-
trol and thus does not consider a compromised first-
party web server. Beyond DANE, SecureBrowse does
not protect from a compromised DNS, for example if
an attacker manages to remove or replace an existing
DNSSEC key and set an own DNS nameserver for
the domain. Furthermore, unlike WEBAPPAUTH, Se-
cureBrowse is unable to protect from attackers who
are able to control the DNS for multiple days, includ-
ing the capability to manipulate DNSSEC keys. In ad-
dition, SecureBrowse does not allow to exclude assets
from protection, which makes it unsuitable in some
scenarios that are covered by WEBAPPAUTH, such as
dynamic generation of HTML or media files.
Varshney and Shah (2021) analyze the threat
of client-side manipulation of web application code
through browser extensions. They propose a DNS-
based security policy framework that enables the
browser to detect such manipulation. Their architec-
ture provides hashes of important pages of the web
application via DNS TXT records, which the browser
can compare with the hashes of the actual pages.
6 CONCLUSION
In this paper, we proposed WEBAPPAUTH that can
protect from very strong attackers who have full con-
trol over all web servers and the domain DNS. It re-
lies on signing client-side code with a private crypto-
graphic key, which the web application operator must
store in a secure location, such as on air-gapped de-
vices. Two independent key registration authorities
verify domain ownership and maintain a public reg-
istry containing the public keys of all domains. These
public keys can then be used by clients to verify
the authenticity of the web application. WEBAPP-
AUTH requires the transmission of only a relatively
low amount of extra data and can be deployed in a
way that does not cause additional delays when load-
ing a web application. It is robust to attackers fully
controlling an attacked domain for a limited time.
As future work, we intend to research server-
side authenticity within our threat model, e. g., using
trusted hardware.
REFERENCES
Akhawe, Devdatta et al. (2016). Subresource Integrity.
W3C Recommendation. URL: https : / / www . w3 . org /
TR/2016/REC-SRI-20160623/.
Barth, Adam, Juan Caballero, and Dawn Song (2009). Se-
cure Content Sniffing for Web Browsers, or How to
Stop Papers from Reviewing Themselves. In: 30th IEEE
S&P, pp. 360–371.
Cap, Clemens and Benjamin Leiding (2018). Ensuring
resource trust and integrity in web browsers using
blockchain technology. In: International Conference on
Advanced Information Systems Engineering, pp. 115–
125.
Cavage, Mark and Manu Sporny (2019). Signing HTTP
Messages. Internet-Draft draft-cavage-http-signatures-
12. URL: https://www.ietf.org/archive/id/draft-cavage-
http-signatures-12.txt.
Chromium Project (2023). HSTS Preload List Submission.
Accessed May 5th, 2023. URL: https://hstspreload.org.
Chuk, Brian and Paul Shapiro (2019). SecureBrowse
Project. URL: https : / / gitlab . com / securebrowse /
securebrowse/-/wikis/The-SecureBrowse-RFC.
Hodges, J., C. Jackson, and A. Barth (2012). HTTP Strict
Transport Security (HSTS). RFC 6797.
Jansen, Frederick et al. (2017). Brief Announcement: Fed-
erated Code Auditing and Delivery for MPC. In: Sta-
bilization, Safety, and Security of Distributed Systems -
19th International Symposium, SSS, pp. 298–302.
Karapanos, Nikolaos et al. (2016). Verena: End-to-End In-
tegrity Protection for Web Applications. In: 37th IEEE
S&P, pp. 895–913.
Laurie, B., A. Langley, and E. Kasper (2013). Certificate
Transparency. RFC 6962.
Levy, Amit, Henry Corrigan-Gibbs, and Dan Boneh (2016).
Stickler: Defending against Malicious Content Distri-
bution Networks in an Unmodified Browser. In: IEEE
Security & Privacy 14.2, pp. 22–28.
Meißner, Dominik, Frank Kargl, and Benjamin Erb (2021).
WAIT: protecting the integrity of web applications
with binary-equivalent transparency. In: SAC ’21: The
36th ACM/SIGAPP Symposium on Applied Computing,
pp. 1950–1953.
Mignerey, Josselin, Cyrille Mucchietto, and Jean-Baptiste
Orfila (2020). Ensuring the Integrity of Outsourced
Web Scripts. In: 17th International Joint Conference
on e-Business and Telecommunications, ICETE 2020 -
Volume 2: SECRYPT, pp. 155–166.
Popa, Raluca Ada et al. (2014). Building Web Applica-
tions on Top of Encrypted Data Using Mylar. In: 11th
USENIX Symposium on Networked Systems Design and
Implementation, NSDI, pp. 157–172.
Rescorla, E. (2018). The Transport Layer Security (TLS)
Protocol Version 1.3. RFC 8446.
Salvador, David, Jordi Cucurull, and Pau Juli
`
a (2018).
wraudit: A Tool to Transparently Monitor Web Re-
sources’ Integrity. In: Mining Intelligence and Knowl-
edge Exploration - 6th International Conference,
MIKE, pp. 239–247.
Sutter, Thomas et al. (2021). Web Content Signing with Ser-
vice Workers. In: arXiv:2105.05551.
Varshney, Gaurav and Naman Shah (2021). A DNS Secu-
rity Policy for Timely Detection of Malicious Modifica-
tion on Webpages. In: 28th International Conference on
Telecommunications (ICT).
SECRYPT 2023 - 20th International Conference on Security and Cryptography
556