crypto-ISSUE-32 (Key security): Section 5.2 in API draft should mention use of secure element in the context of key security [Web Cryptography API]

crypto-ISSUE-32 (Key security): Section 5.2 in API draft should mention use of secure element in the context of key security [Web Cryptography API]

http://www.w3.org/2012/webcrypto/track/issues/32

Raised by: Asad Ali
On product: Web Cryptography API

Initial email from Asad: 

This section talks about key security from a developer’s perspective, but does not mention that key can be stored securely in a secure element such as a smart card. While developers have no guarantee that keys residing in local storage, or indexed DB are safe, secure element storage does offer this assurance. This scenario should be pointed out here.


Comments from Ryan:

Please do raise such an issue.

User agents are NOT required to implement support for secure elements or smart cards, nor (again, speaking as one implementation) if they do implement, are they likely to expose it to 'any' web origin. Thus, I don't know how well this can be promoted as a general purpose solution
- it's very much tied to particular implementations.

Also, with the above text, "local storage, or indexed DB" is a misinterpretation of the text. It's talking about device storage.
"local storage, or indexed DB" are two different APIs for storing name/value pairs (where name is typically called 'key', but for purposes of disambiguation, shall be called name). Just wanted to make sure we're on the same page.

Equally, secure element access has its own security considerations, as mentioned in 5.2, so the overall recommendation stands regardless of device storage vs secure element.

It would be helpful if you could propose some text that you think might address these concerns.

Received on Tuesday, 28 August 2012 17:22:17 UTC