[W3C WebCrypto API WG] Key discovery

Hi,

Relatively early in the webcrypt work I submitted a set of use-cases (to
the public list) that where similar to what you sugests but with a clearer
focus on certificates and there keys. You can find it here
http://lists.w3.org/Archives/Public/public-webcrypto-comments/2012Jul/0000.html
.

I have requirements similar to yours but since I submitted my use-cases I
have learned a lot and changes my position a bit. I still have these
requirements, but I think that it should be coupled to certificates not key
attributes, and maybe not in webcrypto.

If I understand the draft that you sent, this discovery mechanism with
issuer would not be bound to origin. I think this is wrong since by going
outside the SOP we will open pandora's box of security and privacy issues.

One of the things that we would have to consider is that if I can query for
the issuer of eId´s form every site then it would be very easy to track a
user, and the issuer of the eId cannot prevent it. In my initial use-case
the webpage would not get the key reference but just the signature if the
user accepted to sign and something generic none compromising if the user
denied the signature.

In a later mail I suggested to bind certificate and keys to a domain with
an attribute specifying the domain (posible with wildcard), This would put
the issuer in control of the usare of the certificate and keys.

After this I have come  more and more to the conclusion that we really
should leave smart cards out of webcrypto, for the time being at least.
There exists good but propertarian solution for handling smart cards and I
thing that to handle smart-cards we would have to have a much wider scoop.
I think that we should fokus on solution where we do not need smart cards
for example in the nordic countries we are moving away from smart cards for
eId´s and moving towards server-side signares and short lived certificates
(one session only) that is issued when the user can provide some other form
of strong authentication e.g. OTP. Then we have the mobile situation where
smart cards do not suite very well i.e. we need other solutions. Therefor I
think that we should let webcrypto solve problems more relevant to the
future then smart cards.

Best Regards
Samuel Erdtman
Technology Nexus Product Manager