Subject: [KEYPROV] CMS Usage in a Browser Environment

From: Hannes Tschofenig <[email-masked]>
Date: Wed, 19 Jan 2011 12:32:46 +0200

Hi all, 

I am wondering whether someone has gotten some experience with CMS usage in a browser based environment for signing JSON tokens (or other content). 

Ciao
Hannes

PS: I am working with others on a BOF about JSON cryptographic procedures:
http://trac.tools.ietf.org/bof/trac/wiki/WikiStart

---

From: Anders Rundgren <[email-masked]>
Date: Wed, 19 Jan 2011 12:49:39 +0100

Hannes Tschofenig wrote:
> Hi all, 
> 
> I am wondering whether someone has gotten some experience with CMS usage in
a browser based environment for signing JSON tokens (or other content).

Hi Hannes,

I believe almost every browser is running on a cryptographic platform that
supports CMS.  However, they don't expose this functionality because that
would be a security problem unless there is a GUI involved where the user
grants the browser to sign an object including saying which key to use.

This is essentially what I've been ranting about since years back:
you don't get anywhere unless you start programming browsers or know
somebody who do.

What the GUI should contain is depending on the underlaying application.
In WASP (http://webpki.org/papers/wasp/wasp-tutorial.pdf) it is about
signing a document (request), while in KeyGen2 (http://webpki.org/auth-token-4-the-cloud.html)
it is about allowing an issuer creating keys.

I have FWIW downloaded Firefox 4 beta code and have managed to compile
it at least.  Since this isn't my day-job I guess the rest will be slow.
If there is somebody out there who is interested in making browsers more
capable, just drop me a line :-)

Cheers,
Anders

> _______________________________________________
> KEYPROV mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/keyprov
>

---

From: Hannes Tschofenig <[email-masked]>
Date: Wed, 19 Jan 2011 14:09:28 +0200

Hi Anders, 

yes, I vaguely recall that discussion. The issue you raise does not necessarily relate to the cryptographic functionality of CMS but rather the ability to access a key store from JavaScript. This would be largely independent of the actual approach for signing. Right?

While your point is indeed valid the question I have is more along the lines of implementing the cryptographic mechanisms in JavaScript in the browser and whether someone had tried to implement CMS there.

Ciao
Hannes

On Jan 19, 2011, at 1:49 PM, Anders Rundgren wrote:

> Hannes Tschofenig wrote:
>> Hi all, I am wondering whether someone has gotten some experience with CMS usage in

---

From: Anders Rundgren <[email-masked]>
Date: Wed, 19 Jan 2011 13:25:28 +0100

Hannes Tschofenig wrote:
> Hi Anders, 
> 
> yes, I vaguely recall that discussion. The issue you raise does not
 > necessarily relate to the cryptographic functionality of CMS but rather
 > the ability to access a key store from JavaScript. This would be largely
 > independent of the actual approach for signing. Right?
> 
> While your point is indeed valid the question I have is more along the
 > lines of implementing the cryptographic mechanisms in JavaScript in
 > the browser and whether someone had tried to implement CMS there.

I see. This is as you say an entirely different issue.  People have
been doing RSA signatures for a decade in browsers so CMS shouldn't be
problem although I haven't any code for that.

Since native key store access is a no-no, I guess you are talking about
cookies and/or web-db as key stores?

Cheers,
Anders