Re: Webcrypto - project example (and issues)

Hi,

I have not right now an extensive experience with certificates 
manipulation, then if I understand correctly what is behind your summary 
I would say it is OK assuming that it does include certificate generation.

I would add something not specific to certificates only that I did not 
find into the spec if I am correct : handling of format conversion such 
as PEM_to_modulus and vice-versa (see example in node-Tor)

And I would add something that I mentioned in the precedent email like a 
getPeerCertificate (used for example in node.js sockets) but associated 
to the page, for example window.location.certificate where certificate 
is the certificate used to load the main page.

Beside the fact that I would specifically need it for the project, the 
more global rationale is that you might not necessarily trust your 
browser and then might want to doublecheck the certificate verification, 
or do something else with the certificate

Le 16/11/2012 02:49, Mountie Lee a écrit :
> Hi.
>
> the certificate or TLS is belong secondary feature of WebCrypto API.
>
> we are slightly moving to secondary features.
>
> from the multiple pending secondary features of WebCrypto API
> I also have interest for certificate related issues.
>
> can we list-up the requirements for certificate related issues?
>
> followings are my list.
> - API access X509 certificate extensions
> - handling encodings from X509 certificate extensions
> - signature validation with certificate
> - certificate validation with CRL or OCSP
>
>
>
> On Thu, Nov 15, 2012 at 5:03 PM, Aymeric Vitte <vitteaymeric@gmail.com 
> <mailto:vitteaymeric@gmail.com>> wrote:
>
>     The draft project is here : http://www.ianonym.com, the "details"
>     section are not specs but a summary, this is an extension inside
>     the browser of https://github.com/Ayms/node-Tor which is a js
>     implementation over node.js of the Tor project.
>
>     Assuming that the concept works (it seems to on the paper and from
>     some experimentations I made), here is what is needed accessible
>     with js inside the browser and the status today :
>
>         - mix node.js Buffers and Typed Arrays --> OK, home made
>         - URL parser --> OK, home made
>         - HTTP parser --> OK, home made
>         - self signed certificates generation (OP) --> NOK
>         - certificates verification (OP) --> NOK
>         - implement TLS protocol (OP, inside websockets, both client
>     and server side) --> NOK
>         - retrieve the certificate used for the first TLS connection
>     between the page and the OP (Evil1 attack) --> NOK
>         - implement Tor protocol and Tor protocol websocket extension
>     (OP, inside websockets) --> OK, home made
>         - Webcrypto like features (hash, encrypt, decrypt, rsa, aes,
>     etc), including Tor specific ones (RSA_PKCS1_OAEP_PADDING,
>     aes-128-ctr) --> NOK (or OK with Webcrypto API but when ?)
>
>     Beside the overall technical difficulty, one of the problems is
>     not to end up with something obsolete (like most of existing js
>     crypto libraries that are not using Typed Arrays) or not to
>     reinvent what will exist tomorrow.
>
>     And of course, implementing all of this with js will not be
>     efficient, it should better be part of a standard trustable web api.
>
>     Even if Webcrypto API was already implemented, we see here that a
>     lot of things are still missing for this project. I don't know if
>     it is so specific, probably people will have some equivalent ideas
>     of use with or without websockets.
>
>     Unfortunately I did not see other webapis projects implementing
>     for example certificates, TLS protocol. Therefore, maybe it should
>     be considered to extend Webcrypto so it does cover the full chain
>     needed for TLS/SSL communications and crypto tools manipulations
>     (unless you are aware that this does or will exist elsewhere as a
>     standard).
>
>     Regards
>
>     A. Vitte
>
>     -- 
>     jCore
>     Email : avitte@jcore.fr <mailto:avitte@jcore.fr>
>     Web : www.jcore.fr <http://www.jcore.fr>
>     Webble : www.webble.it <http://www.webble.it>
>     Extract Widget Mobile : www.extractwidget.com
>     <http://www.extractwidget.com>
>     BlimpMe! : www.blimpme.com <http://www.blimpme.com>
>
>
>
>
>
>
> -- 
> Mountie Lee
>
> PayGate
> CTO, CISSP
> Tel : +82 2 2140 2700
> E-Mail : mountie@paygate.net <mailto:mountie@paygate.net>
>
> =======================================
> PayGate Inc.
> THE STANDARD FOR ONLINE PAYMENT
> for Korea, Japan, China, and the World
>
>
>
>

-- 
jCore
Email :  avitte@jcore.fr
Web :    www.jcore.fr
Webble : www.webble.it
Extract Widget Mobile : www.extractwidget.com
BlimpMe! : www.blimpme.com