how to sign web pages

Question

using https for websites ensures that the communication is encrypted and comes from and goes to the right server. BUT https is really slow compared to http, it also breaks the http cache protocol.

Sometimes it's enough to ensure the user is on the right domain and the content was not modified during the connection. So what i don't understand is why isn't there a way to make digital sign the web content an send the signiture (or hash) via http header, so the browser can validate the content. The certificate could be made available at a known place or by an additional header field. The resulting Protocol would be compatible with almost every HTTP stuff like caching, proxies, and browsers( if the browser does not understand the header it can ignore it. a new browser could show if the site is valid or not).

So where here is the question: Was this topic discussed before? Or is there a RFC or something that can sign web pages already?

Answer 1

PGP (or GPG) can sign webpages, and the same utility can verify the signatures. There's no support from browsers however, so users would have to manually check the pages.

Honestly it sounds like an interesting idea; the main problem I can think of is trusted distribution of the keys, and signing authorities. The same CAs used for SSL Certs could issue Document Signing certificates (or something similar), but with the lack of any standard or large demand you're in a "chicken and egg" problem.

Answer 2

You can do what you're asking with SSL: Simply configure your server to use a NULL cypher set (e.g. NULL-SHA or NULL-MD5) - Your data will NOT be encrypted however, and it' still subject to the same caveats as any other https connection (caching proxies probably won't work, etc.)

The result is an authenticated connection, but without the overhead of encryption/decryption. Browser support varies however: Some may not be pleased about NULL cyphers, and may make their displeasure known to the user via a warning message.