Re: [W3C Web Crypto WG] Our call today @ 20:00 UTC

On Mon, Sep 28, 2015 at 8:38 AM, Harry Halpin <hhalpin@w3.org> wrote:

> On 09/28/2015 10:47 AM, Charles Engelke wrote:
> > On Mon, Sep 28, 2015 at 10:11 AM, Boris Zbarsky <bzbarsky@mit.edu>
> wrote:
> >> The point is, a spec that has fewer than two implementations can't
> proceed
> >> to the Recommendation stage.  So the unimplemented parts either need to
> get
> >> dropped from the spec or implemented to make progress here.
> > I take your point. But perhaps we should give vendors a bit more time,
> > especially if Apple is ready to move forward again.
> >
> > Also, both PBKDF2 with SHA-1 and AES-CTR are implemented in both
> > Chrome and Firefox on Windows. I just checked them using the test page
> > at https://diafygi.github.io/webcrypto-examples/.
>
> Testing for Chrome/Linux was done on Mac and Linux, except for Edge
> which was done on Windows. Since the crypto varies per platform (thus
> differences in the underlying implementation it appears for Chrome), we
> can as a Working Group decide to expand to per-operating-system
> coverage. I will discuss with PLH (who will be approving our algorithm
> choice) what his opinion is of the per-operating coverage is and how
> this effects both "browser profile" (a sort of unique features I think
> of WebCrypto) and implementation checks.
>

For the sake of this browser profile I don' think we should use the lack of
Chrome Linux support as justification for excluding algorithms.

As mentioned in an earlier thread, Chrome Linux support will match other
platforms on Chrome's stable channel in a few weeks time with the next
release, and the other Chrome platforms already match today.

So for instance PBKDF2 and AES-CTR should be considered implemented by 2 or
more implementations.

Also why is SHA-1 not on the supported list?

Cheers


> I'm happy to redo- the table. In terms of operating systems, we have
> Linux, MacOS, Windows, Android, and iOS. We'd have to set base-lines
> (i.e. 64 bit vs 32 bit, latest *stable* version, etc.). Again, the table
> is just a high-level summary to guide editing the document so we can get
> out of CR per W3C's request when we entered CR.
>
> If someone or a group of people want to help manufacture tests ala
> testthewebforward.org-style, that would be great, and I'm happy to help,
> but I'm not doing that all by myself.
>
> In terms of Apple, I've emailed in the past and will e-mail in the
> future, but their policy is not to comment on future work (We can only
> hope!). I did check with W3C management and dropping the prefix is
> required.
>
>   yours,
>       harry
>
> >
> > It's getting late here. I look forward to reading the meeting notes
> tomorrow.
> >
> > Charlie
> >
>
>
>
>