Re: [Cfrg] Proposed Informational Note: Security Guidelines for Cryptographic Algorithms in the W3C Web Cryptography API

[Yaron Sheffer <[e-mail]>]

>
> Yaron,
>
> For developers, I imagine the important part will be the table, so we
> want extra eyes on that.
>
> We of course cannot fit in a course in cryptography and protocol design
> in an informational document, but we do need to cite the right sources.
> We're also looking for important attacks and proofs we may have missed.
>
> I do agree some kind of "warning, possible hard to understand
> justifications" before we go into per-algorithm justifications, so
> developers are warned. However, if you have any way to justify or
> simplify any of the justifications or the more developer-facing table,
> we'd be very appreciative.
>
> However, I would note the first few uses of Web Crypto did use AES-CBC
> with RSAES-PKCS1-v1_5  :)
>

I actually missed the table on first reading, sorry about that. I think 
the table in general is fine, but I would add to the three AES-xxx a 
comment right there, "MUST be used with a keyed MAC, see sec. yyy" (a 
section that explains what's the proper way of composing encryption and 
integrity protection).

Thanks,
	Yaron