Re: What we were using public key authentication for

On 30 Mar 2016, at 6:00 PM, Dave Longley <[email protected]> =
wrote:

> As a quick, temporary replacement for keygen, you should be able to =
use
> forge (or forge + WebCrypto) to generate a keypair and wrap it in a
> PKCS#12 container that can be downloaded via a link that, when =
clicked,
> may bring up an import dialog in the user's browser. They may have to
> save the file first before importing, I'm not sure.
>=20
> forge: https://github.com/digitalbazaar/forge
>=20
> There's some somewhat messy X.509 cert creation and PKCS#12 code that
> could be adapted from this issue:
>=20
> =
https://github.com/digitalbazaar/forge/issues/211#issuecomment-85447100

Does this guarantee that the key was a) generated on the client side =
only (and not anywhere else and injected into the conversation), and b) =
that this key cannot be subsequently exported and uploaded to some third =
party location under the control of third party server code?

If the answer is no to either, then this isn=E2=80=99t a replacement for =
keygen.

Regards,
Graham
=E2=80=94