Skip to main content
5 of 8
edited title
MikeSchem
  • 2.4k
  • 2
  • 16
  • 37

Is there a protocol that provides data integrity, but not encryption for HTTP?

HTTP

I'm aware that HTTP sends plain text over the network which can be sniffed and modified if a MITM is performed.

HTTPS

On the other hand, HTTPS sends encrypted text over the network that can neither be sniffed nor modified.

Other?

I'm wondering if there is an in between where the traffic can be sniffed, but not modified. I was thinking the server could just sign every packet using a CA.

I'm also aware of manually verifying hashes of files downloaded, but seeing as those hashes are served over a modifiable means (HTTP), it doesn't seem that this really provides any authenticity as the hash could modified to match the modified file. As @mti2935 suggested, the hash could be sent over HTTPS, but I'm looking for a preexisting protocol to handle all this.

MikeSchem
  • 2.4k
  • 2
  • 16
  • 37