[Bug 26080] Remove unsafe named curves from Web Crypto API

https://www.w3.org/Bugs/Public/show_bug.cgi?id=26080

--- Comment #11 from Greg Slepak <hi@okturtles.com> ---
(In reply to virginie.galindo from comment #10)
> (In reply to Greg Slepak from comment #9)
> 
> To sumup the current status of the WG discussions with respect to your
> initial bug demand: 
> 1. The curves that are listed as unsafe in [1] be removed from the Named
> Curves.
> --> the WG discussed during several months the list of algorithms described
> in that spec, removing something is not something we are ready to do at the
> moment. 
> 
> 2. Safe ones be recommended in their place (like Curve25519)
> --> This is currently discussed in the bug
> https://www.w3.org/Bugs/Public/show_bug.cgi?id=25839
> 
> 3. Should any Named Curves be discovered to be unsafe in the future, that
> they be deprecated and eventually removed from the spec.
> --> This is currently discussed in the bug
> https://www.w3.org/Bugs/Public/show_bug.cgi?id=25607. A possible resolution
> could be to reference a document listing the known algorithms weaknesses. 
> 
> With respect to that status, I suggest that we close the bug as WONTFIX
> (while addressing your point #2 and #3, we wont fix #1). 
> 
> Virginie
> Chair of the Web Crypto WG


That seems fair. Feel free to mark this bug as such. :)

-- 
You are receiving this mail because:
You are on the CC list for the bug.

Received on Saturday, 12 July 2014 21:48:10 UTC