RE: Usefulness of WebCrypto API

Agreed. This is part of #2 too though, as far as I can see. You do make a good point that correctly bringing the user into the conversation is important.

From: Seetharama Rao Durbha [mailto:S.Durbha@cablelabs.com]
Sent: Wednesday, October 10, 2012 9:00 AM
To: Vijay Bharadwaj; Ryan Sleevi
Cc: public-webcrypto@w3.org; David Dahl; Emily Stark; Wan-Teh Chang; GALINDO Virginie; Harry Halpin
Subject: Re: Usefulness of WebCrypto API

Vijay
                I also hold the position that ours is just an API - but that becomes messy when the API is getting access to secure elements based on a trust the user places on the browser. The trust translates to 'I trust that you are executing JS from the right server'. As I mentioned in my earlier email - as long as there is no access to external secure elements, yes, ours is just an API. Things break loose with access to 'external' stuff the browser is getting explicit permission from the user to use.

Seetharama

On 10/10/12 8:47 AM, "Vijay Bharadwaj" <Vijay.Bharadwaj@microsoft.com<mailto:Vijay.Bharadwaj@microsoft.com>> wrote:

So it seems to me that there are at least two aspects of "security" and/or "trust" at play here:

1. Server wants to know that client is executing the right script.
2. User wants to know that the script won't harm them.

I think #1 can only be solved by using a crypto API in conjunction with some form of pre-provisioning. The only way for a server to deal with a potentially misbehaving client is to construct a protocol that will fail when the client misbehaves. For example, Netflix appears to be doing this by baking keys into known good client platforms, so that possession of such a key implies something about the platform's trustworthiness. Another way to achieve this may be a smart card used with an external reader that has its own display for the user to verify the transaction being performed.

#2 includes the set of concerns around privacy. We can solve for some of these - for example, we can have the UA display prompts before allowing discovery of, or access to, keys from other origins. Other concerns are not so easy to solve (e.g. UA correctly executes script that allows you to access your health records, but then sends copies of everything to an attacker). Either way, mitigating these concerns requires trusting the client to do the "right thing" for the user. One could layer more stuff on top of the client platform (e.g. DDahl's proposal for having script signed by a store) but the fact remains that you assume a trustworthy execution environment for the script to verify these signatures, for example.

I think part of the disconnect is because developers (as represented in our use cases) are looking at #1 as the primary problem solved by this API, while reviewers are focused on #2. For example, the Facebook use case assumes that the browser is trustworthy though its WebStorage may not be. Consequently, delivering a script to the browser with a public key and some signatures is enough to ensure the browser executes the right script. This improves user responsiveness and prevents one class of attack on the user. The fact that it doesn't prevent other classes of attack (such as Trojans in the browser) is understood and potentially addressed in other ways. From the user's perspective, when used correctly, the API delivers a better web experience without significant increase in risk.

So maybe we should set expectations that implementing a WebCrypto API is not by itself a means of improving the security of web browsers; perhaps that is even a non-goal. The point of having a WebCrypto API is to make it possible to do things in browsers that were hard or impossible to do before, allowing developers to make the right tradeoffs with respect to risk management. We have plausible use cases where such tradeoffs can be made, and the fact that there are many use cases where it doesn't make sense is not necessarily an argument against the API.

So I'm not suggesting that we ignore the security considerations that differentiate web apps from native apps, I'm suggesting that perhaps we should try and convey that WebCrypto is just another API, not "security magic" that renders existing security considerations irrelevant. Leading with the use cases might help reinforce that.

Does that address your points?

-----Original Message-----
From: Ryan Sleevi [mailto:sleevi@google.com]
Sent: Monday, October 8, 2012 2:47 PM
To: Seetharama Rao Durbha
Cc: Vijay Bharadwaj; public-webcrypto@w3.org<mailto:public-webcrypto@w3.org>; David Dahl; Emily Stark; Wan-Teh Chang; GALINDO Virginie; Harry Halpin
Subject: Re: Usefulness of WebCrypto API

On Mon, Oct 8, 2012 at 2:32 PM, Seetharama Rao Durbha <S.Durbha@cablelabs.com<mailto:S.Durbha@cablelabs.com>> wrote:


On 10/8/12 1:22 PM, "Vijay Bharadwaj" <Vijay.Bharadwaj@microsoft.com<mailto:Vijay.Bharadwaj@microsoft.com>> wrote:

Ø  Then, what threat model does crypto in JA make sense for at all?
Obviously, when there's some lack of trust on the server *or*
connection to the server that can be ameliorated by public key crypto.

Harry asked the above on a different email thread. This is an
important question. But first we should be precise about what we're
asking. WebCrypto is not (only) about "crypto in JS". It is about
giving JS access to the crypto capabilities of the underlying
platform. This includes cases in which the actual crypto is done elsewhere such as in a smart card.

To be fair to both Firefox and Chromium, I think there's a little bit of a disconnect, since the crypto of the platform (eg: Windows, Mac, iOS, Android) may be different than the crypto of the browser (eg:
NSS, OpenSSL). But yes, I would certainly agree that it's about giving more access (equivalent to native apps) to web apps, much like WebGL gives more access to the 3D capabilities, or the WebRTC/MediaStream proposals give more access to the audio/video capture capabilities.




So when does it make sense to give JS access to the platform's crypto
capabilities? In my mind, there are a few possible answers.



It makes sense when one wants a trusted piece of JS in a trusted UA to
interact with a less trusted data store. This is the Facebook use
case. It is also David's cloud storage use case if the script is
retrieved from somewhere other than the server that keeps the data.



It makes sense when one wants a trusted piece of JS in a trusted UA to
be able to interoperate with a server using an existing protocol (e.g.
sign requests to access-controlled REST APIs, JimD's use cases on
authenticating to government services).



It makes sense when a server wants to deliver JS that uses a trusted
piece of pre-provisioned crypto hardware to establish end-to-end trust
independent of the UA (e.g. using a smart dongle for online banking,
some of the Netflix use cases).



There may be others, and I'd love to hear what others think.



It's important to note that the "trusted UA" assumption is not as
outlandish as it might seem at first; as Ryan points out on other
threads, we routinely make an assumption that the OS is trusted when talking about native apps.
One does not argue that including crypto APIs in operating systems is
futile just because malware and rootkits exist. Many methods exist to
improve the trust in the UA, including the use of non-browser JS implementations.

<snip>
I am not sure I can agree with this. I think the whole confusion so
far has been regarding our position on the trustability of UA and the
JS it is running. I personally think that we should steer away from
the responsibility of providing a trusted UA. What is a trusted UA,
BTW? A server has no way to say that it is communicating with a trusted UA.
There is also difference between a JS running within a browser on the
far end of the world, and a native application a user is using. As I
pointed out earlier - in the former case, the trust refers to the one
between the server application and the client UA/JS. In the later
case, the trust refers to one between the human user using the app and the app itself. Apples and oranges.

We will have to convince others that this API is not about trust - as
you said earlier, it is a gateway into the crypto functionality
(provided by the
platform) - stronger and uniform. Whether it be preexisting keys or
newly created ones, there is an element of user education when it
comes to implementations. For example, verifying URL of the web site
before accepting a signing request. If the implementation is so bad to
allow injection of malicious JS on their sites, too bad.
</snip>

One could also argue that various crypto primitives - notably hash and
RNG - are only meaningful if one accepts this assumption.



Since this question seems to keep coming up in feedback, maybe we
should develop a position on it as a group. Does anyone else have any
thoughts on the matter?





+1 to clarifying a position as the group, as an introduction for
reviewers and for making sure expectations are set appropriately.

However, just so it's not missed, I do think the security considerations reviewers have raised do come into play when we talk about platform crypto (pre-existing) vs web crypto (web provisioned), so we can't quite ignore those either. As Web Apps become more akin to native apps, we don't want the security model to permit drive-by malware that would otherwise be "prevented" by native app security boundaries.

I think Seetharama's point about two types of trust are relevant to that discussion, particularly when we talk about the user interaction model. Much like the OS use case, we assume and presume some degree of "secure" entry or interaction for some cases.

For example, on the OS side, Windows has its unspoofable security screen to be used for password/pin entry, OS X has the Keychain Access dialogs, and, on some Intel hardware, there are even drivers to integrate directly with the hardware to provide TPM secure entry. On the browser side, the equivalent would be whatever the particular user agent deems as "unspoofable" (different U-A's have different definitions according to their particular browser chrome/ui, but functionally they're the same).

Such screens provide a means for trusted entry (or acknowledgement of permissions, selection of certs, etc) for users, but they do not at all provide any means of "trust" for the web application.