Re: [KEYPROV] CMS Usage in a Browser Environment

Hannes Tschofenig wrote:
> Hi all, 
> 
> I am wondering whether someone has gotten some experience with CMS usage in
a browser based environment for signing JSON tokens (or other content).

Hi Hannes,

I believe almost every browser is running on a cryptographic platform that
supports CMS.  However, they don't expose this functionality because that
would be a security problem unless there is a GUI involved where the user
grants the browser to sign an object including saying which key to use.

This is essentially what I've been ranting about since years back:
you don't get anywhere unless you start programming browsers or know
somebody who do.

What the GUI should contain is depending on the underlaying application.
In WASP (http://webpki.org/papers/wasp/wasp-tutorial.pdf) it is about
signing a document (request), while in KeyGen2 (http://webpki.org/auth-token-4-the-cloud.html)
it is about allowing an issuer creating keys.

I have FWIW downloaded Firefox 4 beta code and have managed to compile
it at least.  Since this isn't my day-job I guess the rest will be slow.
If there is somebody out there who is interested in making browsers more
capable, just drop me a line :-)

Cheers,
Anders

> 
> Ciao
> Hannes
> 
> PS: I am working with others on a BOF about JSON cryptographic procedures:
> http://trac.tools.ietf.org/bof/trac/wiki/WikiStart
> 
> _______________________________________________
> KEYPROV mailing list
> KEYPROV@ietf.org
> https://www.ietf.org/mailman/listinfo/keyprov
> 