- From: Nick Van den Bleeken <Nick.Van.den.Bleeken@inventivegroup.com>
- Date: Thu, 23 May 2013 10:42:33 +0000
- To: Nikos Mavrogiannopoulos <nikos.mavrogiannopoulos@esat.kuleuven.be>
- CC: "<public-webcrypto-comments@w3.org>" <public-webcrypto-comments@w3.org>, danny de cock <Danny.DeCock@esat.kuleuven.be>, Filipe Beato <filipe.beato@esat.kuleuven.be>
Hi Nikos, I'm also interested in smart card support, but it is currently considered out-of-scope by the browser vendors, for at least the first version of the specification. The current Web Crypto API doesn't prevent the use of Smart Cards to perform the cryptographic operations. There is just no way to get access to a smart card if they aren't pre-provisioned with a specific name for a specific origin (see WebCrypto Key Discovery[1], but this spec might not be implemented by Browser vendors). About the cloning, I believe that this isn't a problem for smart cards, because the 'structured clone' in the spec doesn't mean that you have to clone the key material it just means cloning the javascript key object that points to the key material (in an implementation dependent way). Kind regards, Nick Van den Bleeken 1: https://dvcs.w3.org/hg/webcrypto-keydiscovery/raw-file/tip/Overview.html On 23 May 2013, at 10:40, Nikos Mavrogiannopoulos <nikos.mavrogiannopoulos@esat.kuleuven.be> wrote: > Our reading of the API suggests that it is not sufficient to handle smart cards. Smart cards are widely available security tokens (citizen IDs in several countries are such) that allow cryptographic operations with a private key that is not extractable. The private key is typically PIN protected. > > In our view what is needed to support those keys: > * Generation: > The generateKey should allow the specification of a location (e.g., with a PKCS #11 URL [0]), and it should be able to return an identifier that can be used to access the object. > > * Cloning: > The ability to clone a key on an SC should not be assumed. > > * Importing: > A way to import a named key (e.g., using a PKCS #11 URL) should be allowed to access a smart card key. > > * Exporting > Non-Extractable keys should not be expected to be exported, nor any private key parameters should be accessible. > > > Note that from a user interface perspective the user should be warned by the browser prior to allowing any access on its smart cards by a webapp. > > [0]. http://tools.ietf.org/html/draft-pechanec-pkcs11uri-09 > > > > > > ________________________________ Inventive Designers' Email Disclaimer: http://www.inventivedesigners.com/email-disclaimer
Received on Thursday, 23 May 2013 10:43:09 UTC