Subject: [Cfrg] Request from W3C Web Crypto WG to adopt "Security Considerations" document?

From: Harry Halpin <[email-masked]>
Date: Tue, 22 Jul 2014 01:07:15 +0200

CFRG,

  The W3C Web Cryptography Working Group has an open issue on Security
Considerations for the Web Cryptography API [1], with details in the
bugzilla [2].

 Graham Steel (INRIA), with feedback from Rich Salz and help from the
W3C staff, is willing to help create a "per-algorithm" security
consideration Informational RFC for the algorithms listed in the Web
Cryptography API (see his blog post [3]). However, as the landscape of
algorithms is changing and the Web Cryptography Working Group may have a
finite lifespan, we thought the CFRG would be a place to host such a
document as the CFRG will continue after the Web Crypto Working Group
ends and the CFRG obviously has the experience and expertise to help
make sure such a document reaches the high standards the Internet
community deserves.

Would the CFRG be OK with publishing such a document and maintaining it,
if we took the effort to produce the first draft and the W3C helped in
maintaining it? We think such a list of known attacks on a popular
subset of algorithms would be useful also to other IETF and W3C
standards, although the need is most pressing with the Web Crypto API.

Although I will not be at IETF Toronto, Wendy Seltzer from the W3C will
be, and we hope this can be discussed during the "AOB" session at the
CFRG meeting.

Please inform us over at the Web Cryptography WG if this proposal is
accepted by CFRG.

  cheers,
    harry

[1]https://dvcs.w3.org/hg/webcrypto-api/raw-file/tip/spec/Overview.html
[2]https://www.w3.org/Bugs/Public/show_bug.cgi?id=25607
[3]http://cryptosense.com/choice-of-algorithms-in-the-w3c-crypto-api/

---

From: "Paterson, Kenny" <[email-masked]>
Date: Tue, 22 Jul 2014 18:26:42 +0000

Dear Harry,

The CFRG would be interested in being involved in this activity. As you
say, it should have wider applicability than W3C, and there's a good
chance that CFRG will have a greater longevity than the WebCrypto working
group.

With luck, the CFRG session here in Toronto tomorrow will not be so packed
with other things that we can't squeeze a few words from Wendy Seltzer
into the AoB. The CFRG chairs are also around all week if she wants to
catch us beforehand.

Regards,

Kenny 

On 21/07/2014 19:07, "Harry Halpin" <[email-masked]> wrote:

>_______________________________________________
>Cfrg mailing list
>[email-masked]
>http://www.irtf.org/mailman/listinfo/cfrg
>