- From: Ryan Sleevi <sleevi@google.com>
- Date: Fri, 4 Oct 2013 14:07:23 -0700
- To: Richard Barnes <rbarnes@bbn.com>
- Cc: Web Cryptography Working Group <public-webcrypto@w3.org>
On Fri, Oct 4, 2013 at 2:03 PM, Richard Barnes <rbarnes@bbn.com> wrote:
> Hey all,
>
> I've been thinking about some identity use cases for WebCrypto, and in several cases, it seems useful for someone who looks at a key object to be able to tell if it only exists in that browser instance. The "extractable" attribute provides part of that, but you still have to know that the key was generated by the host, and not by importKey or unwrapKey.
>
> Proposal: Add an attribute to the Key interface ("provenance" or "source") that specifies how the key was introduced to the API. Possible values are "generate" and "import", indicating that the key was generated by the browser or imported by some other JS code, respectively.
>
> It seems like it would be trivial for browsers to set this attribute, and there are no other API changes needed. And it seems like being able to know this property of keys could lead to some interesting applications.
>
> Cheers,
> --Richard
Can you please describe these applications?
I'm extremely reticent to introduce API surface changes simply because
it "might" be useful, without a clear and demonstrated use case (and
how an application cannot already accomplish this today).
I do not see any such need for this today, since an application can
already know - because keys are not shared and fully controlled by the
application.
Received on Friday, 4 October 2013 21:07:49 UTC