Shen: A Security Scheme for the World Wide Web

This document describes a security scheme for the World Wide Web. Because different users require different levels of security more than one scheme is defined.

This work is based on many of discussions with many people including Tim Berners-Lee, Ari Luotonen, Dave Ragget, Marc VanHeyningen, Rob McCool, Henrik Frystyk Nielsen and another. In addition a number of other people made various suggestions along the way whose origins I have forgotten.

The emphasis of this work has been on supporting the functionalities required for web users. In many cases these functionalities emphasise authentication as opposed to encryption and commercial considerations as opposed to political ones.

The scheme described provides for three separate security related mechanisms.

• Weak Authentication with low maintenance overhead and without patent or export restrictions.
• Strong Authentication via public key exchange.
• Strong Encryption of message content.

• Requirements
• Authorisation and Proxy Servers
• Attack Model
• Header Tags used
• Examples
• Legal Issues
• Glossary
• Work in progress