- From: Web Cryptography Working Group Issue Tracker <sysbot+tracker@w3.org>
- Date: Thu, 30 Aug 2012 23:49:47 +0000
- To: public-webcrypto@w3.org
crypto-ISSUE-38: Key initialization and "finalization" [Web Cryptography API] http://www.w3.org/2012/webcrypto/track/issues/38 Raised by: Ryan Sleevi On product: Web Cryptography API It is common in cryptographic APIs that there is a distinct state of Keys that are first being created, to allow them to have attributes mutated or to allow keying material to be exported or escrowed, up until some point where the key is "finalized", and no further changes are supported. An example use case for such feature would be: - Generating a new keypair, escrowing the private key using a key escrow pprovider, then marking the generated key as non-exportable. Future attempts to export the key will fail once it has been "finalized". - Creating a key, then defining one or more attributes after creation (perhaps after first registering the key with an authority), but then "finalizing" the key such that the attributes become read-only. While I realize that this use case hasn't been brought up yet, the prevalence of such APIs seems that they may affect how key generation/derivation behaves, and thus we should consider whether such use cases should be prohibited - implicitly by choice of API, or explicitly by text.
Received on Thursday, 30 August 2012 23:49:48 UTC