WAIT：以二进制等价透明性保护Web应用完整性
WAIT: Protecting the Integrity of Web Applications with Binary-Equivalent Transparency
AI总结：
WAIT通过浏览器扩展、自定义HTTP头和公共可验证日志，使Web应用修改透明化，从而提升客户端应用完整性验证能力和提供商可问责性。
摘要：
现代单页Web应用需要在客户端执行应用逻辑，包括客户端密码学等关键功能。现有的TLS和子资源完整性（Subresource Integrity）等机制能够保障通信安全并提供外部资源完整性。然而，浏览器无法感知服务器所提供的客户端应用是否被修改，用户在面对服务器端实施的恶意修改时仍然脆弱。我们的解决方案使此类修改变得透明，并赋予浏览器基于可公开验证日志来验证Web应用完整性的能力。我们的Web应用完整性透明性（WAIT）方法要求：（1）一个用于浏览器进行本地完整性验证的扩展，（2）一个用于托管应用的Web服务器的自定义HTTP头，以及（3）提供可验证日志的公共日志服务器。借助WAIT，浏览器可以禁止执行未公开的应用更改。同时，Web应用提供商也无法再否认其已发布修改的作者身份。尽管我们的方法无法阻止所有可设想的针对客户端Web应用完整性的攻击，但它为用户引入了一种新颖的透明性，并为应用提供商带来了更高程度的可问责性，尤其对有针对性的内部攻击有效。
英文摘要：
Modern single page web applications require client-side executions of application logic, including critical functionality such as client-side cryptography. Existing mechanisms such as TLS and Subresource Integrity secure the communication and provide external resource integrity. However, the browser is unaware of modifications to the client-side application as provided by the server and the user remains vulnerable against malicious modifications carried out on the server side. Our solution makes such modifications transparent and empowers the browser to validate the integrity of a web application based on a publicly verifiable log. Our Web Application Integrity Transparency (WAIT) approach requires (1) an extension for browsers for local integrity validations, (2) a custom HTTP header for web servers that host the application, and (3) public log servers that serve the verifiable logs. With WAIT, the browser can disallow the execution of undisclosed application changes. Also, web application providers cannot dispute their authorship for published modifications anymore. Although our approach cannot prevent every conceivable attack on client-side web application integrity, it introduces a novel sense of transparency for users and an increased level of accountability for application providers particularly effective against targeted insider attacks.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
