As a prototype application we have developed modules that extend a standard web server and a standard web browser to use proof-carrying authorization to control access to web pages. Our framework makes it possible to locate and use pieces of the security policy that have been distributed across arbitrary hosts. The web browser generates proofs iteratively by repeatedly fetching proof components until a proof can be constructed. We provide for iterative authorization, by which a server can require a browser to prove a series of challenges. Our prototype implementation includes a series of optimizations, such as speculative proving and modularizing and caching proofs, which allows proof-carrying authorization to be used with minimal performance and bandwidth overheads.
Ongoing work includes further development of our prototype application.
We will investigate the use of oblivous transfer for fetching proof components without revealing unnecessary information and refine our security logic to reduce its trusted base and increase its generality. We are also exploring the idea of using a higher-order logic as a bridge between security logics in a way that would enable authentication frameworks based on different logics to interact and share resources. Proof-Carrying Authentication . Andrew W. Appel and Edward W. Felten, 6th ACM Conference on Computer and Communications Security , November 1999.