Re: [Cfrg] Request from W3C Web Crypto WG to adopt "Security Considerations" document?

["Paterson, Kenny" <[e-mail]>]

Harry

Excellent, thanks for confirming. We await your draft with interest!

Cheers,

Kenny 

On 04/08/2014 20:42, "Harry Halpin" <[e-mail]> wrote:

>On 07/22/2014 08:26 PM, Paterson, Kenny wrote:
>> Dear Harry,
>> 
>> The CFRG would be interested in being involved in this activity. As you
>> say, it should have wider applicability than W3C, and there's a good
>> chance that CFRG will have a greater longevity than the WebCrypto
>>working
>> group.
>> 
>> With luck, the CFRG session here in Toronto tomorrow will not be so
>>packed
>> with other things that we can't squeeze a few words from Wendy Seltzer
>> into the AoB. The CFRG chairs are also around all week if she wants to
>> catch us beforehand.
>
>
>I believe Wendy managed to discuss this in the CFRG AOB. Just to
>confirm, we will produce an Informational RFC for the consideration of
>CFRG as soon as possible for the per-algorithm security considerations.
>The W3C appreciates the support of the CFRG in this matter, which we
>agree may have wider applicability than the W3C Web Cryptography API.
>
>  thanks,
>       harry
>
>
>> 
>> Regards,
>> 
>> Kenny 
>> 
>> On 21/07/2014 19:07, "Harry Halpin" <[e-mail]> wrote:
>> 
>>> CFRG,
>>>
>>>  The W3C Web Cryptography Working Group has an open issue on Security
>>> Considerations for the Web Cryptography API [1], with details in the
>>> bugzilla [2].
>>>
>>> Graham Steel (INRIA), with feedback from Rich Salz and help from the
>>> W3C staff, is willing to help create a "per-algorithm" security
>>> consideration Informational RFC for the algorithms listed in the Web
>>> Cryptography API (see his blog post [3]). However, as the landscape of
>>> algorithms is changing and the Web Cryptography Working Group may have
>>>a
>>> finite lifespan, we thought the CFRG would be a place to host such a
>>> document as the CFRG will continue after the Web Crypto Working Group
>>> ends and the CFRG obviously has the experience and expertise to help
>>> make sure such a document reaches the high standards the Internet
>>> community deserves.
>>>
>>> Would the CFRG be OK with publishing such a document and maintaining
>>>it,
>>> if we took the effort to produce the first draft and the W3C helped in
>>> maintaining it? We think such a list of known attacks on a popular
>>> subset of algorithms would be useful also to other IETF and W3C
>>> standards, although the need is most pressing with the Web Crypto API.
>>>
>>> Although I will not be at IETF Toronto, Wendy Seltzer from the W3C will
>>> be, and we hope this can be discussed during the "AOB" session at the
>>> CFRG meeting.
>>>
>>> Please inform us over at the Web Cryptography WG if this proposal is
>>> accepted by CFRG.
>>>
>>>  cheers,
>>>    harry
>>>
>>> [1]https://dvcs.w3.org/hg/webcrypto-api/raw-file/tip/spec/Overview.html
>>> [2]https://www.w3.org/Bugs/Public/show_bug.cgi?id=25607
>>> [3]http://cryptosense.com/choice-of-algorithms-in-the-w3c-crypto-api/
>>>
>>> _______________________________________________
>>> Cfrg mailing list
>>> [e-mail]
>>> http://www.irtf.org/mailman/listinfo/cfrg
>>>
>> 
>