Re: I want to have unsafe key exchange.

----- Original Message -----
> From: "Zooko Wilcox-OHearn" <zooko@leastauthority.com>
> To: public-webcrypto@w3.org
> Sent: Thursday, June 14, 2012 9:44:42 AM
> Subject: I want to have unsafe key exchange.
> 
> 
<snip> 
> So, I don't really understand whether all the discussion of
> protecting
> keys and identifying them by key IDs means that the uses I envision
> --
> unprotected keys -- will be unsupported.
> 

Initially, I think this was not a use case that was in mind for the API. However, we have discussed a few operations where this would be required to support specific protocols. I think in most cases, we would not want developers using this kind of 'the footgun is loaded' operation.

> Will the spec require implementers to offer an API to extract the
> complete bytes of a private key or symmetric key, and to create a
> private key or symmetric key from a string of bytes?
> 

As far as symmetric keys are concerned, I have been thinking we would spec out a wrapped key object, with the unwrapping happening out of the content JS scope. With a compelling use-case I can see an API that allows raw key material to be generated that is perhaps not persisted and not given any kind of ID. Would that satisfy your usage?

Do you have a use case written down for this kind of operation?

David

Received on Thursday, 14 June 2012 15:50:45 UTC