Re: [KEYPROV] CMS Usage in a Browser Environment

Hannes Tschofenig wrote:
> Hi Anders, 
> 
> yes, I vaguely recall that discussion. The issue you raise does not
 > necessarily relate to the cryptographic functionality of CMS but rather
 > the ability to access a key store from JavaScript. This would be largely
 > independent of the actual approach for signing. Right?
> 
> While your point is indeed valid the question I have is more along the
 > lines of implementing the cryptographic mechanisms in JavaScript in
 > the browser and whether someone had tried to implement CMS there.

I see. This is as you say an entirely different issue.  People have
been doing RSA signatures for a decade in browsers so CMS shouldn't be
problem although I haven't any code for that.

Since native key store access is a no-no, I guess you are talking about
cookies and/or web-db as key stores?

Cheers,
Anders

> 
> Ciao
> Hannes
> 
> On Jan 19, 2011, at 1:49 PM, Anders Rundgren wrote:
> 
>> Hannes Tschofenig wrote:
>>> Hi all, I am wondering whether someone has gotten some experience with CMS usage in
>> a browser based environment for signing JSON tokens (or other content).
>>
>> Hi Hannes,
>>
>> I believe almost every browser is running on a cryptographic platform that
>> supports CMS.  However, they don't expose this functionality because that
>> would be a security problem unless there is a GUI involved where the user
>> grants the browser to sign an object including saying which key to use.
>>
>> This is essentially what I've been ranting about since years back:
>> you don't get anywhere unless you start programming browsers or know
>> somebody who do.
>>
>> What the GUI should contain is depending on the underlaying application.
>> In WASP (http://webpki.org/papers/wasp/wasp-tutorial.pdf) it is about
>> signing a document (request), while in KeyGen2 (http://webpki.org/auth-token-4-the-cloud.html)
>> it is about allowing an issuer creating keys.
>>
>> I have FWIW downloaded Firefox 4 beta code and have managed to compile
>> it at least.  Since this isn't my day-job I guess the rest will be slow.
>> If there is somebody out there who is interested in making browsers more
>> capable, just drop me a line :-)
>>
>> Cheers,
>> Anders
>>
>>> Ciao
>>> Hannes
>>> PS: I am working with others on a BOF about JSON cryptographic procedures:
>>> http://trac.tools.ietf.org/bof/trac/wiki/WikiStart
>>> _______________________________________________
>>> KEYPROV mailing list
>>> KEYPROV@ietf.org
>>> https://www.ietf.org/mailman/listinfo/keyprov
>>
>> _______________________________________________
>> KEYPROV mailing list
>> KEYPROV@ietf.org
>> https://www.ietf.org/mailman/listinfo/keyprov
> 
> 