Re: What we were using public key authentication for

--001a11432154ade539052f467cc3
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

On Wed, Mar 30, 2016 at 9:09 AM, Graham Leggett <[email protected]> wrote:

> On 30 Mar 2016, at 6:00 PM, Dave Longley <[email protected]>
> wrote:
>
> > As a quick, temporary replacement for keygen, you should be able to use
> > forge (or forge + WebCrypto) to generate a keypair and wrap it in a
> > PKCS#12 container that can be downloaded via a link that, when clicked,
> > may bring up an import dialog in the user's browser. They may have to
> > save the file first before importing, I'm not sure.
> >
> > forge: https://github.com/digitalbazaar/forge
> >
> > There's some somewhat messy X.509 cert creation and PKCS#12 code that
> > could be adapted from this issue:
> >
> > https://github.com/digitalbazaar/forge/issues/211#issuecomment-85447100
>
> Does this guarantee that the key was a) generated on the client side only
> (and not anywhere else and injected into the conversation),


I do not believe you can do this with WebCrypto. Why do you believe that
this is a requirement?


and b) that this key cannot be subsequently exported and uploaded to some
> third party location under the control of third party server code?
>

WebCrypto does support this.

However, note that it does not support taking WebCrypto keys and inserting
them into the HTTPS stack

-Ekr



>
> If the answer is no to either, then this isn=E2=80=99t a replacement for =
keygen.
>
> Regards,
> Graham
> =E2=80=94
>
>
>

--001a11432154ade539052f467cc3
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><br><div class=3D"gmail_extra"><br><div class=3D"gmail_quo=
te">On Wed, Mar 30, 2016 at 9:09 AM, Graham Leggett <span dir=3D"ltr">&lt;<=
a href=3D"mailto:[email protected]" target=3D"_blank">[email protected]</a>&g=
t;</span> wrote:<br><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0=
 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class=3D"">On 30 M=
ar 2016, at 6:00 PM, Dave Longley &lt;<a href=3D"mailto:dlongley@digitalbaz=
aar.com">[email protected]</a>&gt; wrote:<br>
<br>
&gt; As a quick, temporary replacement for keygen, you should be able to us=
e<br>
&gt; forge (or forge + WebCrypto) to generate a keypair and wrap it in a<br=
>
&gt; PKCS#12 container that can be downloaded via a link that, when clicked=
,<br>
&gt; may bring up an import dialog in the user&#39;s browser. They may have=
 to<br>
&gt; save the file first before importing, I&#39;m not sure.<br>
&gt;<br>
&gt; forge: <a href=3D"https://github.com/digitalbazaar/forge" rel=3D"noref=
errer" target=3D"_blank">https://github.com/digitalbazaar/forge</a><br>
&gt;<br>
&gt; There&#39;s some somewhat messy X.509 cert creation and PKCS#12 code t=
hat<br>
&gt; could be adapted from this issue:<br>
&gt;<br>
&gt; <a href=3D"https://github.com/digitalbazaar/forge/issues/211#issuecomm=
ent-85447100" rel=3D"noreferrer" target=3D"_blank">https://github.com/digit=
albazaar/forge/issues/211#issuecomment-85447100</a><br>
<br>
</span>Does this guarantee that the key was a) generated on the client side=
 only (and not anywhere else and injected into the conversation), </blockqu=
ote><div><br></div><div>I do not believe you can do this with WebCrypto. Wh=
y do you believe that this is a requirement?</div><div><br></div><div><br><=
/div><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-le=
ft:1px #ccc solid;padding-left:1ex">and b) that this key cannot be subseque=
ntly exported and uploaded to some third party location under the control o=
f third party server code?<br></blockquote><div><br></div><div>WebCrypto do=
es support this.</div><div><br></div><div>However, note that it does not su=
pport taking WebCrypto keys and inserting them into the HTTPS stack</div><d=
iv><br></div><div>-Ekr</div><div><br></div><div>=C2=A0</div><blockquote cla=
ss=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;pa=
dding-left:1ex">
<br>
If the answer is no to either, then this isn=E2=80=99t a replacement for ke=
ygen.<br>
<br>
Regards,<br>
Graham<br>
=E2=80=94<br>
<br>
<br>
</blockquote></div><br></div></div>

--001a11432154ade539052f467cc3--