Re: [Cfrg] Proposed Informational Note: Security Guidelines for Cryptographic Algorithms in the W3C Web Cryptography API

"Salz, Rich" <rsalz@akamai.com> Thu, 20 November 2014 15:59 UTC

From: "Salz, Rich" <rsalz@akamai.com>
To: Harry Halpin <hhalpin@w3.org>, "cfrg@irtf.org" <cfrg@irtf.org>
Date: Thu, 20 Nov 2014 10:59:27 -0500
Thread-Topic: [Cfrg] Proposed Informational Note: Security Guidelines for Cryptographic Algorithms in the W3C Web Cryptography API
Thread-Index: AdAE2BnzNGQquWiKTeyXeXPBziKSfAAAbDcA
Message-ID: <2A0EFB9C05D0164E98F19BB0AF3708C71D5211CE6D@USMBX1.msg.corp.akamai.com>
References: <546E0AE5.3040601@w3.org>
In-Reply-To: <546E0AE5.3040601@w3.org>
Accept-Language: en-US
Content-Language: en-US
acceptlanguage: en-US
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Archived-At: http://mailarchive.ietf.org/arch/msg/cfrg/ujqXB9MY4IW_4uRRiUYJJ8yVfQk
Subject: Re: [Cfrg] Proposed Informational Note: Security Guidelines for Cryptographic Algorithms in the W3C Web Cryptography API
Precedence: list

Great, this is good progress.

> Note that draft, while attempting

I think you mean "Note that /this/ draft"
 
If this document is intended to be stand-alone, you need to describe the columns in Table 1.  Last line of that table has an extra close-paren.

Shouldn't sec4 be right after 1?

I think you should either do just-webcrypto, or explicitly say 'many/most ietf rfcs'  My pref is just webcrypto.  Drop pkcs1.5 et al.  Or move it and the non-WebCrypto ones to an appendix.

I think you need a table of acronyms near the beginning; CCA is used in table 1 for example.  And redefined in Rogaways' quote in 5.7

This is a very useful document, thanks.
--  
Principal Security Engineer, Akamai Technologies
IM: rsalz@jabber.me Twitter: RichSalz

[Cfrg] Proposed Informational Note: Security Guid… Harry Halpin
Re: [Cfrg] Proposed Informational Note: Security … Salz, Rich
Re: [Cfrg] Proposed Informational Note: Security … Watson Ladd
Re: [Cfrg] Proposed Informational Note: Security … Jonathan Berliner
Re: [Cfrg] Proposed Informational Note: Security … Paul Hoffman
Re: [Cfrg] Proposed Informational Note: Security … Scott Fluhrer (sfluhrer)
Re: [Cfrg] Proposed Informational Note: Security … Manuel Pégourié-Gonnard
Re: [Cfrg] Proposed Informational Note: Security … Yaron Sheffer
Re: [Cfrg] Proposed Informational Note: Security … David Gil
Re: [Cfrg] Proposed Informational Note: Security … Watson Ladd
Re: [Cfrg] Proposed Informational Note: Security … Harry Halpin
Re: [Cfrg] Proposed Informational Note: Security … Yaron Sheffer
Re: [Cfrg] Proposed Informational Note: Security … Harry Halpin
Re: [Cfrg] Proposed Informational Note: Security … Harry Halpin
Re: [Cfrg] Proposed Informational Note: Security … Dan Brown
Re: [Cfrg] Proposed Informational Note: Security … Yaron Sheffer
Re: [Cfrg] Proposed Informational Note: Security … Dan Harkins
Re: [Cfrg] Proposed Informational Note: Security … Manuel Pégourié-Gonnard