Skip to main content
  • Suggested IETF 123 Sessions for Getting Familiar with New Topics

    These IETF 123 meeting sessions are likely to include discussions and proposals that are accessible to a broad range of Internet technologists whether they are new to the IETF or long-time participants.

    8 Jul 2025
  • Experiences from IGF 2025

    At the Internet Governance Forum 2025 in Norway (23-27 June), the presence of the IETF was well-received as part of the broader effort to strengthen the connection between technical and policy discussions, helping to build trust, increase visibility and highlight the role of the technical community in Internet governance.

    2 Jul 2025
  • Progress on AI Preferences

    In January, the IETF chartered the AI Preferences (AIPREF) Working Group to make it easier to express how AI models should use Internet content. With a compressed timeline for delivery, it’s a good time to update those who haven't been following the work closely.

    29 Jun 2025
  • IETF LLC Board Retreat 2025

    The IETF Administration LLC (IETF LLC) Board met for its annual strategic retreat 6-7 May 2025 in Amsterdam, where it discussed the future strategy of the IETF LLC, as well as high priority operational issues.

    24 Jun 2025
  • Report from the Tools Team Retreat 2025

    The IETF Administration LLC (IETF LLC) development team met along with IETF LLC senior leadership for its annual two-day retreat, and with the IETF Chair able to join remotely for key sessions. This post reviews the key inputs and outputs of that retreat, and how they affect the IETF.

    16 Jun 2025

Filter by topic and date

Filter by topic and date

Privacy and Trustworthiness for Web Notifications

18 Oct 2017

RFC 8188 builds on existing protocols to provide a new option for delivering trustworthy messages containing confidential information over the Internet.

Mailboxes with flags

HTTPS (HTTP over TLS) is possibly the most widely used security protocol in existence. HTTPS is a two-party protocol; it involves a single client and a single server. This aspect of the protocol limits the ways in which it can be used.

The recently published RFC 8188 provides protocol designers a new option for building multi-party protocols with HTTPS by defining a standardized format for encrypting HTTP message bodies. While this tool is less capable than other encryption formats, like CMS (RFC 5652) or JOSE (RFC 7516), it is designed for simplicity and ease-of-integration with existing HTTP semantics.

The WebPush protocol (RFC 8030) provides an example of the how the encrypted HTTP content coding could be used.

In WebPush, there are three parties: a user agent (in most cases this is a Web browser), an application server, and a push service. The push service is an HTTP server that has a special relationship with the user agent. The push service can wake a user agent from sleep and contact it even though it might be behind a firewall or NAT.

The application server uses the push service to send a push message to a user agent. The push service receives a message from the application server, and then forwards the contents of the push message to the user agent at the next opportunity. It is important here to recognize that the push service only forwards messages. It has no need to see or modify push messages. Both the user agent and the application server only communicate via the push service, but they both want some assurance that the push service cannot read or modify push messages. Nor do they want the push service to be able to create false push messages.

For example, an alerting service might use WebPush to deliver alerts to mobile devices without increased battery drain. Push message encryption ensures that these messages are trustworthy and allows the messages to contain confidential information.

The document draft-ietf-webpush-encryption, which was recently approved for publication as an RFC, describes how push messages can be encrypted using RFC 8188. The encrypted content coding ensures that the push service has access to the information it needs, such as URLs and HTTP header fields, but that the content of push messages is protected.

WebPush is available in some web browsers through the W3C Push API, which requires push message encryption.


Share this page