crypto-ISSUE-17: Define the scope and API for custom key attributes [Web Cryptography API]

crypto-ISSUE-17: Define the scope and API for custom key attributes [Web Cryptography API]

http://www.w3.org/2012/webcrypto/track/issues/17

Raised by: Ryan Sleevi
On product: Web Cryptography API

During the July Face-to-Face, vgb proposed a definition of key attributes grouped into three categories - functional, advisory/supplementary, and scope.

Of these, only functional attributes (such as the algorithm family, size, usage) were seen as immutable attributes. Advisory/supplementary and scope represent potentially mutable attributes for an application. Some may be provided, but not enforced, by the user agent, whereas others may be wholly defined and enforced by the underlying application.

For attributes defined by the application, the question is whether to define a custom storage mechanism on the Key object, or whether they should be implemented by applications via existing web platform APIs. An example of an existing API might be utilizing localStorage ( http://www.w3.org/TR/webstorage/ ) or IndexedDB ( http://www.w3.org/TR/IndexedDB/ ) to associate attributes with the key, using the Key's ID as a key with the underlying storage mechanism.

Arguments In Favor:
 - It tightly couples supplementary attributes with Keys, allowing pre-provisioned Keys to have pre-provisioned attributes exposed via the API.
 - Clearing the IndexedDB or Web Storage will not erase application-critical attributes for keys.

Arguments Against:
 - It represents yet-another-Key-Value-storage mechanism, except this one tightly coupled to Keys

Received on Monday, 6 August 2012 05:26:11 UTC