About Bug 25607 : Need to advise authors about security considerations

Dear all,

Again about this bug 25607 : https://www.w3.org/Bugs/Public/show_bug.cgi?id=25607


With respect to online and offline discussions I had with different people, I believe there is still need to have some discussion about having some references in order to improve the security recommendation of our specification. I know that this issue has already been discussed and resolved in the past, but due to the comments we received during the last call, I believe it is worth re-discussing it.

Graham Steele from INRIA/Cryptosense has written a post [1], including a table, which collects his recent research about state of art on algorithm 'reliability'. This table discusses some algorithm we do not reference for the moment, and it includes some controversial result.

But I would like to know what is the appetite for the working group to include in our web crypto API a reference to Graham post, or include a similar table in the Web Crypto API. This reference or table would be associated with a warning saying that 'at the time this specification is edited, it reflects the state of the art that the WG collected, and developers and implementers are encouraged to research the recent security updates prior to implementing or using the algorithms' or a similar sentence to clarify that this is just a screen shot of state of the art in summer 2014.

Any thought on the principle to integrate a similar table in the spec or to reference Graham post?

Regards,
Virginie

[1] http://cryptosense.com/choice-of-algorithms-in-the-w3c-crypto-api/


-----Original Message-----
From: bugzilla@jessica.w3.org [mailto:bugzilla@jessica.w3.org]
Sent: mardi 17 juin 2014 19:22
To: public-webcrypto@w3.org
Subject: [Bug 25607] Need to advise authors about security considerations

https://www.w3.org/Bugs/Public/show_bug.cgi?id=25607


--- Comment #12 from Ryan Sleevi <sleevi@google.com> --- (In reply to Rich Salz from comment #11)
> I read the commit diff and nothing in it addresses any of the issues
> raised
> here:
>      The misleading term "recommended" is still used.
>      There is no section on security references
>      Specific guidance about avoiding known-bad mechanisms is not
> present

Please review the editor's draft
https://dvcs.w3.org/hg/webcrypto-api/raw-file/tip/spec/Overview.html (in particular, the change from https://dvcs.w3.org/hg/webcrypto-api/file/71498804a64d/spec/Overview.html )

The language that was incorporated was language from Vijay that you had
(seemingly) agreed met your requirements.

To your specific points:
- The misleading term "recommended" is still used.
  - Please review the editor's draft. In particular, see https://dvcs.w3.org/hg/webcrypto-api/raw-file/71498804a64d/spec/Overview.html#algorithm-recommendations


  The term "recommended" has a particular meaning in the specification world, not just the security world, and given as this is a specification, it's used to signify just that - recommended for implementers of this spec.

- There is no section on security references
  - I believe we're at a WONTFIX here, because we've identified that the spec is not a place to discuss these

- Specific guidance about avoiding known-bad mechanisms is not present
  - Please review the editor's draft. In particular, https://dvcs.w3.org/hg/webcrypto-api/raw-file/71498804a64d/spec/Overview.html#algorithm-recommendations


>
> If you insist on putting it into RESOLVED state, the honest thing to
> do is make it WONTFIX.

There has certainly been every effort to understand and respect your concerns.
Additionally, multiple explanations have been provided as to why some of these concerns are out of scope or inappropriate for this spec.

I encourage you to read the editor's draft, as a whole, at https://dvcs.w3.org/hg/webcrypto-api/raw-file/tip/spec/Overview.html - as well as review the log - https://dvcs.w3.org/hg/webcrypto-api/log


This bug contains many elements that are duplicate with already existing bugs (as you note), and so other elements of concern have been addressed separately, in those bugs.

--
You are receiving this mail because:
You are on the CC list for the bug.

________________________________
 This message and any attachments are intended solely for the addressees and may contain confidential information. Any unauthorized use or disclosure, either whole or partial, is prohibited.
E-mails are susceptible to alteration. Our company shall not be liable for the message if altered, changed or falsified. If you are not the intended recipient of this message, please delete it and notify the sender.
Although all reasonable efforts have been made to keep this transmission free from viruses, the sender will not be liable for damages caused by a transmitted virus.

Received on Thursday, 19 June 2014 13:53:10 UTC