Re: [Cfrg] Proposed Informational Note: Security Guidelines for Cryptographic Algorithms in the W3C Web Cryptography API

[Yaron Sheffer <[e-mail]>]

On 11/20/2014 08:09 PM, Watson Ladd wrote:
>
> On Nov 20, 2014 9:49 AM, "Yaron Sheffer" <[e-mail]
> <mailto:[e-mail]>> wrote:
>  >
>  > Hi Harry,
>  >
>  > The draft makes for fascinating reading for CFRG folks, as can be
> seen by the mailing list discussion. But I think it does not make any
> sense to "developers" (programmers who typically have next to no
> understanding of crypto, and certainly none at all of formal security
> models/proofs). They simply would not understand 90% of the text.
>
>  >
>  > So it may be fine as a rationale for the selected list of algorithms.
> It may be fine for a few star crypto developers. But IMHO, not for the
> general population of people who'll be coding to your API.
>
> Should people who don't know anything about cryptography write code that
> uses it? We've already mentioned that protocol design is hard, but that
> will force a lot of other choices, so it's not clear what is actually
> addressed by these recommendations.
>
> Unlike TLS this is not about properly configuring an implementation.
> It's a case where the developers have unbounded creativity, and so can
> mess it up in unexpected ways, which no list of negative commandments
> can cover.
>
> The right approach is to design misuse resistant primitives on top of
> the ones in Webcrypto, and tell programmers to use them.
>
> Sincerely,
> Watson Ladd
>

I mostly agree with you, but this document was introduced to the group 
as "better security guidelines for developers". I'm afraid it is not.

Thanks,
	Yaron