[Cfrg] general guidance for web programmers?

["Zooko Wilcox-O'Hearn" <[e-mail]>]

Dear people of CFRG:

I'm participating in the W3C working group on Web Crypto. (By the way,
thank you very much to those who replied to my earlier request for
feedback on the WebCrypto draft.)

An issue facing the W3C working group is how and to what degree we
include guidance about which algorithms are recommended or which are
known to be flawed. The first issue that we face is what to say about
ECB mode. I propose ¹ that the WebCrypto standard include some text
warning that ECB mode is *not* an encryption mode, like CBC and CTR
modes, which can be used to encrypt arbitrary sensitive plaintext.

Others on the WebCrypto Working Group are very reluctant to start
writing down advice of this kind ² , because where will it end? It can
get very complicated. Why should we be the ones who have to explain to
programmers to use SHA-2-256 instead of SHA-1, and how to avoid
length-extension attacks if they're going to use SHA-2-256, and how to
safely use RSA PKCS#1 v1.5, and how to generate nonces, counters, and
IVs correctly, and how strong integrity really is almost always
necessary in addition to confidentiality, and so on.

Anyway, we're not necessarily the experts on all those details, and
new attacks are coming along all the time that we would have to
scramble to integrate into our advice.

So, we have conflicting desires here. On the one hand, we don't want
to attempt to explain everything that needs explaining, but on the
other hand experience shows that simply providing a bare API without
documentation really does lead to the deployment of insecure systems
that compromise people's safety. (See my post to the web-crypto
mailing list ¹ for an interesting recent example in which the design
of the crypto API made the difference between secure and insecure web
sessions.)

Okay, so here's a good solution: the WebCrypto spec can refer to
documents published by some other experts, such as CFRG, which guides
programmers on which algorithms are recommended, as well as what are
the requirements for the use of a given algorithm to secure. I very
much like section 3 of the cipher catalog ³, and I wonder if it would
make sense for the WebCrypto standard to refer to that.

The use of ECB mode itself isn't addressed in the cipher catalog. Are
there other similar publications from CFRG that would address that
issue?

(As an aside, I rather like the pithiness of OWASP's take on the
subject ⁴: “This mode should not be used under any circumstances.”.)

What about the dangers of RSA PKCS#1 v1.5? Or at least, a catalog of
public key algorithms which advises one to use safer algorithms in
place of that one?

Thanks very much for any help you can offer.

Regards,

Zooko

¹ http://lists.w3.org/Archives/Public/public-webcrypto/2012Oct/0018.html

² http://lists.w3.org/Archives/Public/public-webcrypto/2012Sep/0188.html

³ http://tools.ietf.org/html/draft-irtf-cfrg-cipher-catalog-00

⁴ http://owasp.com/index.php/Glossary#Electronic_Code_Book_mode