Re: removing keygen from HTML
Henry Story <[email protected]> Wed, 1 Jun 2016 10:02:41 +0200
| Newsgroups | gmane.org.w3c.tag |
|---|---|
| Message-ID | <[email protected]> |
--Apple-Mail=_28AD0648-4116-4295-BA65-A958EB0F1FB5 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 > On 31 May 2016, at 14:12, Harry Halpin <[email protected]> wrote: >=20 >=20 >=20 > On Tue, May 31, 2016 at 1:40 AM, Reto Gm=C3=BCr <[email protected] = <mailto:[email protected]>> wrote: > On Tue, 31 May 2016, at 10:04, Harry Halpin wrote: >> I do not know anyone from the cryptographic or security community = that would support keeping <keygen>. Indeed, the default response from = the security/crypto community would be to drop <keygen> due to legacy = usage of MD5 and violation of security boundaries (SOP).=20 >=20 > That would also be my response if I was employed by the NSA and wanted = to prevent technologies that allow user controlled strong cryptography = and decentralized networks of trust (as enabled by webId). > =20 >=20 > Reto, >=20 > That was both an idiotic and offensive statement. Can you explain how = amateur > crypto and home-brewed protocols that no-one in the security or crypto = community > reviewed or supports is the way to fight the NSA? Harry this shows a complete misunderstanding of WebID over TLS. =20 WebID over TLS is just TLS client side authentication In other forums you have been advocating switching over to HTTPS eg = here=20 https://lists.w3.org/Archives/Public/semantic-web/2016May/0089.html = <https://lists.w3.org/Archives/Public/semantic-web/2016May/0089.html> > If the Semantic Web doesn't gracefully deal with the upgrade from HTTP = to > TLS, it will date itself quite quickly and will not be usable for any > real-world usage I suppose you are not going to say that TLS is a home brewed protocol? =20 Well I have news for you WebID-TLS is just TLS client authentication,=20 which has been, and keeps being, reviewed by top security analysts.=20 The extension we have done to TLS is so minimal that we did not even have to invent a new X509 field. X509 since over 15 years comes with two extra fields: - the subject alternative name - the issuer alternative name each of which can take a URI. We just use that, in pretty much the same way OpenID uses URIs to = identify people.=20 That's pretty much the end of where we innovated. As you see there is = no need=20 to do cryptography. Certainly nowhere near as much as anything that = requires the=20 Web Cryptography JavaScript API libraries that all are in the namespace = "subtle"=20 for a good reason. > Myself and many others support strong cryptography and decentralized = networks > of trust, and fully support that effort. Mine and others assessment of what you have actually been doing is very = different, much closer to spreading Fear Uncertainty and Doubt (aka FUD) than to = the role you=20 should be playing as a W3C staff member. This e-mail is a case in point.=20= > Rather than attribute the use of broken technology > to protocols to NSA, it's also possibly due to lack of education.=20 >=20 > Thus, you may want to look at: >=20 > 1) MD5 security issues are well-known and documented: > http://merlot.usc.edu/csac-f06/papers/Wang05a.pdf = <http://merlot.usc.edu/csac-f06/papers/Wang05a.pdf> > 2) In practice, the WebID+TLS community should use modern crypto and = the Web Security model rather than attempt to build on top of an broken, = obscure, and unstandardised browser behaviour. If you want to fight the = NSA by building new protocols on the Web, I recommend taking a class = that explains how Web security works. Videos are available from this MIT = course explain modern Web Security, including the Same Origin Policy: > https://www.youtube.com/watch?v=3D_1C62Twf0vs = <https://www.youtube.com/watch?v=3D_1C62Twf0vs> We all know about these Harry. If you stopped taking the people you are = communicating=20 with for idiots you may actually start hearing the arguments we are = putting forward. Lets take your two points: 1) "MD5 security issues": most other protocols including TLS actually = then moved on from MD5.=20 They did not stop at that point and give up. Here for example is the = extract from RFC5246 TLS1.2=20 > The MD5/SHA-1 combination in the pseudorandom function (PRF) has > been replaced with cipher-suite-specified PRFs. All cipher = suites > in this document use P_SHA256. We were expecting similar improvements to the Keygen functionality. 2) "WebID+TLS community should use modern crypto" =20 As mentioned we use TLS which keeps evolving. Are you saying that the = whole TLS work=20 is outdated crypto? Then you state that you have a replacement of keygen, but that is not = deployed and not a finished spec. How could we use that? And how can we verify that it does indeed do what = you claim it does? 3) "the Web Security model" by which you mean I suppose given your = comments below,=20 the "Single Origin Policy" which is exactly what is under discussion, = and which the TAG finding points out is not broken by client certificates usage that keep the user = in control.=20 Your not understanding point 3) is what makes me somewhat suspicious of = any work you recommend, as that is fundamental to what keygen enables to make widely and cheaply = available with client side certificates inside TLS. Note also that we are not fundabmentally tied to TLS: I have similar = implementations that work with=20 the WebCrypto API, though there of course there is a much bigger risk of = things going wrong, and=20 sadly that offers nealy no user control when compared to that offered by = client side certificates. >=20 > Hopefully others will be more reasonable, but you may wish to = familiarize yourself with this thread rather than endlessly repeat it.=20= > = https://groups.google.com/a/chromium.org/forum/#!topic/blink-dev/pX5NbX0Xa= ck = <https://groups.google.com/a/chromium.org/forum/#!topic/blink-dev/pX5NbX0X= ack> That is a very long thread that is really interesting but that would not = be the best use of anyone's time to read through in=20 full. I do recommend this post where I go into the so called "security = issues" of MD5 as related to keygen = https://groups.google.com/a/chromium.org/d/msg/blink-dev/pX5NbX0Xack/dn_7R= guGAAAJ and why it is actually not as big a security issue as it seems to be = (it's subtle, so read with care). All it means=20 is that there are cetain types of things one cannot do with = certificates. (note that we do look forward to=20 improvements to a future keygen of course ). It is my feeling that the TAG's finding is a much better place to start = discussions from, as it tries to have a principled view of the discussion. >=20 > Note that we're just modernizing with W3C Web Authentication secure = and modern cryptographic one-factor authentication to use modern = primitives and respect user privacy. You are more than welcome to join = the Working Group as an Invited Expert, although an expert should be = aware of the basics of security. =20 so you start out your mail from the position that none of us who work in = WebID-TLS understand anything about crypto, and then you suggest that we are welcome as invited experts to join the = WG..... Can you try to be consistent within one e-mail message? >=20 > Although there are a number of inaccuracies in this report in terms of = WebCrypto, it's pretty clear Web Authentication matches all requirements = in Section 6 here: > http://w3ctag.github.io/client-certificates/ = <http://w3ctag.github.io/client-certificates/> >=20 > Thus, it makes sense to hold off and deprecate <keygen> after the fall = of this year, when Web Authentication is deployed in browsers. As stated = earlier, the "WebID" community can simply use Web Authentication rather = than client certs for authentication.=20 >=20 > That being said, since the only browser that supports <keygen> = currently is Mozilla, who plans to deprecate regardless of what the TAG = says, then it can also be justified to remove from the standard today as = there is no interoperability.=20 As someone who studied philosophy (and not cryptography) you should be = aware of the power of reasoned discussion to change people's points of view. Certainly new facts on the = ground should when relevant change one's behavior. And there is a lot that is changing in this space, including = improvements to TLS client certificate authentication=20 for HTTP2.0 as for example the RFC proposal by Mozilla and Microsoft, = whose most recent draft was just published a little over a week ago: = https://tools.ietf.org/html/draft-bishop-httpbis-http2-additional-certs-01= = <https://tools.ietf.org/html/draft-bishop-httpbis-http2-additional-certs-0= 1> So as you see TLS client certificates is continuously being worked on by = top cryptographers, who most certainly are not "home brewed", but active members of the W3C = which you are meant to represent. =20 <keygen> provides very important functionality to allow those protocols = to work on the web.=20 Now perhaps the Work you are advocating is going to be better that what = we currently have. Great. But if so why advocate removing a key feature of the old system = that would make comparison of the two technologies difficult? Why the hurry? >=20 > cheers, > harry >=20 >=20 > =20 > Cheers, > Reto > =20 > =20 >=20 --Apple-Mail=_28AD0648-4116-4295-BA65-A958EB0F1FB5 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 <html><head><meta http-equiv=3D"Content-Type" content=3D"text/html = charset=3Dutf-8"></head><body style=3D"word-wrap: break-word; = -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" = class=3D""><br class=3D""><div><blockquote type=3D"cite" class=3D""><div = class=3D"">On 31 May 2016, at 14:12, Harry Halpin <<a = href=3D"mailto:[email protected]" class=3D"">[email protected]</a>>= wrote:</div><br class=3D"Apple-interchange-newline"><div class=3D""><div = dir=3D"ltr" class=3D""><br class=3D""><div class=3D"gmail_extra"><br = class=3D""><div class=3D"gmail_quote">On Tue, May 31, 2016 at 1:40 AM, = Reto Gm=C3=BCr <span dir=3D"ltr" class=3D""><<a = href=3D"mailto:[email protected]" target=3D"_blank" = class=3D"">[email protected]</a>></span> wrote:<br class=3D""><blockquote = class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px = solid rgb(204,204,204);padding-left:1ex"><u class=3D""></u> <div class=3D""><span class=3D""><div class=3D"">On Tue, 31 May 2016, at = 10:04, Harry Halpin wrote:<br class=3D""></div> <blockquote type=3D"cite" class=3D""><div dir=3D"ltr" class=3D""><div = class=3D""><div class=3D""><div class=3D"">I do not know anyone from the = cryptographic or security community that would support keeping = <keygen>. Indeed, the default response from the security/crypto = community would be to drop <keygen> due to legacy usage of MD5 and = violation of security boundaries (SOP). <br class=3D""></div> </div> </div> </div> </blockquote></span><div class=3D"">That would also be my response if I = was employed by the NSA and wanted to prevent technologies that allow = user controlled strong cryptography and decentralized networks of trust = (as enabled by webId).<br class=3D""></div> <div class=3D""> <br class=3D""></div></div></blockquote><div = class=3D""><br class=3D""></div><div class=3D"">Reto,<br class=3D""><br = class=3D""></div><div class=3D"">That was both an idiotic and offensive = statement. Can you explain how = amateur</div></div></div></div></div></blockquote><blockquote = type=3D"cite" class=3D""><div class=3D""><div dir=3D"ltr" class=3D""><div = class=3D"gmail_extra"><div class=3D"gmail_quote"><div class=3D"">crypto = and home-brewed protocols that no-one in the security or crypto = community</div></div></div></div></div></blockquote><blockquote = type=3D"cite" class=3D""><div class=3D""><div dir=3D"ltr" class=3D""><div = class=3D"gmail_extra"><div class=3D"gmail_quote"><div class=3D"">reviewed = or supports is the way to fight the NSA?<br = class=3D""></div></div></div></div></div></blockquote><div><br = class=3D""></div><div>Harry this shows a complete misunderstanding of = WebID over TLS. </div><div>WebID over TLS is just TLS client = side authentication</div><div><br class=3D""></div><div>In other forums = you have been advocating switching over to HTTPS eg = here </div><div><a = href=3D"https://lists.w3.org/Archives/Public/semantic-web/2016May/0089.htm= l" = class=3D"">https://lists.w3.org/Archives/Public/semantic-web/2016May/0089.= html</a></div><div><br class=3D""></div><div><blockquote type=3D"cite" = class=3D""><div style=3D"margin: 0px; font-size: 12px; line-height: = normal; font-family: Monaco;" class=3D"">If the Semantic Web doesn't = gracefully deal with the upgrade from HTTP to</div><div style=3D"margin: = 0px; font-size: 12px; line-height: normal; font-family: Monaco;" = class=3D"">TLS, it will date itself quite quickly and will not be usable = for any</div><div style=3D"margin: 0px; font-size: 12px; line-height: = normal; font-family: Monaco;" class=3D"">real-world = usage</div></blockquote></div><div><br class=3D""></div><div>I suppose = you are not going to say that TLS is a home brewed = protocol?</div><div> </div><div>Well I have news for you WebID-TLS = is just TLS client authentication, </div><div>which has been, and = keeps being, reviewed by top security analysts. </div><div><br = class=3D""></div><div>The extension we have done to TLS is so minimal = that we did not even</div><div>have to invent a new X509 field. X509 = since over 15 years comes with two</div><div>extra = fields:</div><div> - the subject alternative name</div><div> = - the issuer alternative name</div><div>each of which can take a = URI.</div><div><br class=3D""></div><div>We just use that, in pretty = much the same way OpenID uses URIs to identify = people. </div><div>That's pretty much the end of where we = innovated. As you see there is no need </div><div>to do = cryptography. Certainly nowhere near as much as anything that requires = the </div><div>Web Cryptography JavaScript API libraries that all = are in the namespace "subtle" </div><div>for a good = reason.</div><div><br class=3D""></div><blockquote type=3D"cite" = class=3D""><div dir=3D"ltr" class=3D""><div class=3D"gmail_extra"><div = class=3D"gmail_quote"><div class=3D"">Myself and many others support = strong cryptography and decentralized = networks</div></div></div></div></blockquote><blockquote type=3D"cite" = class=3D""><div class=3D""><div dir=3D"ltr" class=3D""><div = class=3D"gmail_extra"><div class=3D"gmail_quote"><div class=3D"">of = trust, and fully support that effort. = </div></div></div></div></div></blockquote><div><br = class=3D""></div><div>Mine and others assessment of what you have = actually been doing is very different,</div><div>much closer to = spreading Fear Uncertainty and Doubt (aka FUD) than to the role = you </div><div>should be playing as a W3C staff member. This e-mail = is a case in point. </div><br class=3D""><blockquote type=3D"cite" = class=3D""><div class=3D""><div dir=3D"ltr" class=3D""><div = class=3D"gmail_extra"><div class=3D"gmail_quote"><div class=3D"">Rather = than attribute the use of broken = technology</div></div></div></div></div></blockquote><blockquote = type=3D"cite" class=3D""><div class=3D""><div dir=3D"ltr" class=3D""><div = class=3D"gmail_extra"><div class=3D"gmail_quote"><div class=3D"">to = protocols to NSA, it's also possibly due to lack of education. <br = class=3D""><br class=3D"">Thus, you may want to look at:<br = class=3D""></div><div class=3D""><br class=3D"">1) MD5 security issues = are well-known and documented:<br class=3D""><a = href=3D"http://merlot.usc.edu/csac-f06/papers/Wang05a.pdf" = class=3D"">http://merlot.usc.edu/csac-f06/papers/Wang05a.pdf</a></div></di= v></div></div></div></blockquote><blockquote type=3D"cite" class=3D""><div= class=3D""><div dir=3D"ltr" class=3D""><div class=3D"gmail_extra"><div = class=3D"gmail_quote"><div class=3D""><br class=3D""></div><div = class=3D"">2) In practice, the WebID+TLS community should use modern = crypto and the Web Security model rather than attempt to build on top of = an broken, obscure, and unstandardised browser behaviour. If you want to = fight the NSA by building new protocols on the Web, I recommend taking a = class that explains how Web security works. Videos are available from = this MIT course explain modern Web Security, including the Same Origin = Policy:<br class=3D""><a = href=3D"https://www.youtube.com/watch?v=3D_1C62Twf0vs" = class=3D"">https://www.youtube.com/watch?v=3D_1C62Twf0vs</a><br = class=3D""></div></div></div></div></div></blockquote><div><br = class=3D""></div><div>We all know about these Harry. If you stopped = taking the people you are communicating </div><div>with for = idiots you may actually start hearing the arguments we are putting = forward.</div><div><br class=3D""></div><div>Lets take your two = points:</div><div><br class=3D""></div><div>1) "MD5 security issues": = most other protocols including TLS actually then moved on from = MD5. </div><div>They did not stop at that point and give up. Here = for example is the extract from RFC5246 TLS1.2 </div><div><div><br = class=3D""></div><div><blockquote type=3D"cite" class=3D""><pre = class=3D"newpage" style=3D"font-size: 13.3333px; margin-top: 0px; = margin-bottom: 0px; font-variant-ligatures: normal; = font-variant-position: normal; font-variant-numeric: normal; = font-variant-alternates: normal; font-variant-east-asian: normal; = line-height: normal; widows: 1;"> The MD5/SHA-1 combination in the = pseudorandom function (PRF) has been replaced with cipher-suite-specified PRFs. All cipher suites in this document use P_SHA256. </pre></blockquote><div class=3D""><pre class=3D"newpage" = style=3D"font-size: 13.3333px; margin-top: 0px; margin-bottom: 0px; = font-variant-ligatures: normal; font-variant-position: normal; = font-variant-numeric: normal; font-variant-alternates: normal; = font-variant-east-asian: normal; line-height: normal; widows: 1;"><br = class=3D""></pre><pre class=3D"newpage" style=3D"font-size: 13.3333px; = margin-top: 0px; margin-bottom: 0px; font-variant-ligatures: normal; = font-variant-position: normal; font-variant-numeric: normal; = font-variant-alternates: normal; font-variant-east-asian: normal; = line-height: normal; widows: 1;"> <font face=3D"Helvetica" class=3D""> = We were expecting similar improvements to the Keygen = functionality.</font></pre><pre class=3D"newpage" style=3D"font-size: = 13.3333px; margin-top: 0px; margin-bottom: 0px; font-variant-ligatures: = normal; font-variant-position: normal; font-variant-numeric: normal; = font-variant-alternates: normal; font-variant-east-asian: normal; = line-height: normal; widows: 1;"><font face=3D"Helvetica" class=3D""><br = class=3D""></font></pre><pre class=3D"newpage" style=3D"margin-top: 0px; = margin-bottom: 0px; font-variant-ligatures: normal; = font-variant-position: normal; font-variant-numeric: normal; = font-variant-alternates: normal; font-variant-east-asian: normal; = line-height: normal; widows: 1;"><font face=3D"Helvetica" class=3D""><font= size=3D"4" class=3D"">2)</font> "WebID+TLS community should use modern = crypto" <font size=3D"4" class=3D""> </font></font></pre><pre = class=3D"newpage" style=3D"font-size: 13.3333px; margin-top: 0px; = margin-bottom: 0px; font-variant-ligatures: normal; = font-variant-position: normal; font-variant-numeric: normal; = font-variant-alternates: normal; font-variant-east-asian: normal; = line-height: normal; widows: 1;"><font face=3D"Helvetica" class=3D""><br = class=3D""></font></pre><pre class=3D"newpage" style=3D"margin-top: 0px; = margin-bottom: 0px; font-variant-ligatures: normal; = font-variant-position: normal; font-variant-numeric: normal; = font-variant-alternates: normal; font-variant-east-asian: normal; = line-height: normal; widows: 1;"><font face=3D"Helvetica" class=3D""><font= size=3D"4" class=3D""> </font> As mentioned we use TLS which keeps = evolving. Are you saying that the whole TLS work </font></pre><pre = class=3D"newpage" style=3D"margin-top: 0px; margin-bottom: 0px; = font-variant-ligatures: normal; font-variant-position: normal; = font-variant-numeric: normal; font-variant-alternates: normal; = font-variant-east-asian: normal; line-height: normal; widows: 1;"><font = face=3D"Helvetica" class=3D"">is outdated crypto?</font></pre><pre = class=3D"newpage" style=3D"margin-top: 0px; margin-bottom: 0px; = font-variant-ligatures: normal; font-variant-position: normal; = font-variant-numeric: normal; font-variant-alternates: normal; = font-variant-east-asian: normal; line-height: normal; widows: 1;"><font = face=3D"Helvetica" class=3D""><br class=3D""></font></pre><pre = class=3D"newpage" style=3D"margin-top: 0px; margin-bottom: 0px; = font-variant-ligatures: normal; font-variant-position: normal; = font-variant-numeric: normal; font-variant-alternates: normal; = font-variant-east-asian: normal; line-height: normal; widows: 1;"><font = face=3D"Helvetica" class=3D"">Then you state that you have a replacement = of keygen, but that is not deployed and not a finished = spec.</font></pre><pre class=3D"newpage" style=3D"margin-top: 0px; = margin-bottom: 0px; font-variant-ligatures: normal; = font-variant-position: normal; font-variant-numeric: normal; = font-variant-alternates: normal; font-variant-east-asian: normal; = line-height: normal; widows: 1;"><font face=3D"Helvetica" class=3D"">How = could we use that? And how can we verify that it does indeed do what you = claim it does?</font></pre><pre class=3D"newpage" style=3D"font-size: = 13.3333px; margin-top: 0px; margin-bottom: 0px; font-variant-ligatures: = normal; font-variant-position: normal; font-variant-numeric: normal; = font-variant-alternates: normal; font-variant-east-asian: normal; = line-height: normal; widows: 1;"><font face=3D"Helvetica" class=3D""><br = class=3D""></font></pre><pre class=3D"newpage" style=3D"margin-top: 0px; = margin-bottom: 0px; font-variant-ligatures: normal; = font-variant-position: normal; font-variant-numeric: normal; = font-variant-alternates: normal; font-variant-east-asian: normal; = line-height: normal; widows: 1;"><font face=3D"Helvetica" class=3D""><font= size=3D"4" class=3D"">3) </font>"the Web Security model" by which you = mean I suppose given your comments below, </font></pre><pre = class=3D"newpage" style=3D"margin-top: 0px; margin-bottom: 0px; = font-variant-ligatures: normal; font-variant-position: normal; = font-variant-numeric: normal; font-variant-alternates: normal; = font-variant-east-asian: normal; line-height: normal; widows: 1;"><font = face=3D"Helvetica" class=3D"">the "Single Origin Policy" which is = exactly what is under discussion, and which the TAG = finding</font></pre><pre class=3D"newpage" style=3D"margin-top: 0px; = margin-bottom: 0px; font-variant-ligatures: normal; = font-variant-position: normal; font-variant-numeric: normal; = font-variant-alternates: normal; font-variant-east-asian: normal; = line-height: normal; widows: 1;"><font face=3D"Helvetica" = class=3D"">points out is not broken by client certificates usage that = keep the user in control. </font></pre><pre class=3D"newpage" = style=3D"margin-top: 0px; margin-bottom: 0px; font-variant-ligatures: = normal; font-variant-position: normal; font-variant-numeric: normal; = font-variant-alternates: normal; font-variant-east-asian: normal; = line-height: normal; widows: 1;"><font face=3D"Helvetica" class=3D""><br = class=3D""></font></pre><pre class=3D"newpage" style=3D"margin-top: 0px; = margin-bottom: 0px; font-variant-ligatures: normal; = font-variant-position: normal; font-variant-numeric: normal; = font-variant-alternates: normal; font-variant-east-asian: normal; = line-height: normal; widows: 1;"><font face=3D"Helvetica" class=3D"">Your = not understanding point 3) is what makes me somewhat suspicious of any = work you recommend,</font></pre><pre class=3D"newpage" = style=3D"margin-top: 0px; margin-bottom: 0px; font-variant-ligatures: = normal; font-variant-position: normal; font-variant-numeric: normal; = font-variant-alternates: normal; font-variant-east-asian: normal; = line-height: normal; widows: 1;"><font face=3D"Helvetica" class=3D"">as = that is fundamental to what keygen enables to make widely and cheaply = available with client</font></pre><pre class=3D"newpage" = style=3D"margin-top: 0px; margin-bottom: 0px; font-variant-ligatures: = normal; font-variant-position: normal; font-variant-numeric: normal; = font-variant-alternates: normal; font-variant-east-asian: normal; = line-height: normal; widows: 1;"><font face=3D"Helvetica" class=3D"">side = certificates inside TLS.</font></pre><pre class=3D"newpage" = style=3D"margin-top: 0px; margin-bottom: 0px; font-variant-ligatures: = normal; font-variant-position: normal; font-variant-numeric: normal; = font-variant-alternates: normal; font-variant-east-asian: normal; = line-height: normal; widows: 1;"><font face=3D"Helvetica" class=3D""><br = class=3D""></font></pre><pre class=3D"newpage" style=3D"margin-top: 0px; = margin-bottom: 0px; font-variant-ligatures: normal; = font-variant-position: normal; font-variant-numeric: normal; = font-variant-alternates: normal; font-variant-east-asian: normal; = line-height: normal; widows: 1;"><font face=3D"Helvetica" class=3D"">Note = also that we are not fundabmentally tied to TLS: I have similar = implementations that work with </font></pre><pre class=3D"newpage" = style=3D"margin-top: 0px; margin-bottom: 0px; font-variant-ligatures: = normal; font-variant-position: normal; font-variant-numeric: normal; = font-variant-alternates: normal; font-variant-east-asian: normal; = line-height: normal; widows: 1;"><font face=3D"Helvetica" class=3D"">the = WebCrypto API, </font><span style=3D"font-family: Helvetica;" = class=3D"">though there of course there is a much bigger risk of things = going wrong, and </span></pre><pre class=3D"newpage" = style=3D"margin-top: 0px; margin-bottom: 0px; font-variant-ligatures: = normal; font-variant-position: normal; font-variant-numeric: normal; = font-variant-alternates: normal; font-variant-east-asian: normal; = line-height: normal; widows: 1;"><span style=3D"font-family: Helvetica;" = class=3D"">sadly that offers nealy no </span><span style=3D"font-family: = Helvetica;" class=3D"">user control when compared to that offered by = client side certificates.</span></pre></div></div><blockquote = type=3D"cite" class=3D""><div dir=3D"ltr" class=3D""><div = class=3D"gmail_extra"><div = class=3D"gmail_quote"></div></div></div></blockquote></div><br = class=3D""><blockquote type=3D"cite" class=3D""><div class=3D""><div = dir=3D"ltr" class=3D""><div class=3D"gmail_extra"><div = class=3D"gmail_quote"><div class=3D""><br class=3D"">Hopefully others = will be more reasonable, but you may wish to familiarize yourself with = this thread rather than endlessly repeat it. <br class=3D""><a = href=3D"https://groups.google.com/a/chromium.org/forum/#!topic/blink-dev/p= X5NbX0Xack" = class=3D"">https://groups.google.com/a/chromium.org/forum/#!topic/blink-de= v/pX5NbX0Xack</a><br = class=3D""></div></div></div></div></div></blockquote><div><br = class=3D""></div><div>That is a very long thread that is really = interesting but that would not be the best use of anyone's time to read = through in </div><div>full. I do recommend this post where I = go into the so called "security issues" of MD5 as related to = keygen</div><div><br class=3D""></div><div> <a = href=3D"https://groups.google.com/a/chromium.org/d/msg/blink-dev/pX5NbX0Xa= ck/dn_7RguGAAAJ" = class=3D"">https://groups.google.com/a/chromium.org/d/msg/blink-dev/pX5NbX= 0Xack/dn_7RguGAAAJ</a></div><div><br class=3D""></div><div>and why it is = actually not as big a security issue as it seems to be (it's subtle, so = read with care). All it means </div><div>is that there are cetain = types of things one cannot do with certificates. (note that we do look = forward to </div><div>improvements to a future keygen of course = ).</div><div><br class=3D""></div><div>It is my feeling that the TAG's = finding is a much better place to start discussions from, as it = tries</div><div>to have a principled view of the discussion.</div><br = class=3D""><blockquote type=3D"cite" class=3D""><div class=3D""><div = dir=3D"ltr" class=3D""><div class=3D"gmail_extra"><div = class=3D"gmail_quote"><div class=3D""><br class=3D""></div><div = class=3D"">Note that we're just modernizing with W3C Web Authentication = secure and modern cryptographic one-factor authentication to use modern = primitives and respect user privacy. You are more than welcome to join = the Working Group as an Invited Expert, although an expert should be = aware of the basics of security. <br = class=3D""></div></div></div></div></div></blockquote><div><br = class=3D""></div><div>so you start out your mail from the position that = none of us who work in WebID-TLS understand anything about crypto, = and</div><div>then you suggest that we are welcome as invited experts to = join the WG..... Can you try to be consistent within = one</div><div>e-mail message?</div><div><br class=3D""></div><blockquote = type=3D"cite" class=3D""><div class=3D""><div dir=3D"ltr" class=3D""><div = class=3D"gmail_extra"><div class=3D"gmail_quote"><div class=3D""><br = class=3D""></div><div class=3D"">Although there are a number of = inaccuracies in this report in terms of WebCrypto, it's pretty clear Web = Authentication matches all requirements in Section 6 here:<br = class=3D""><a href=3D"http://w3ctag.github.io/client-certificates/" = class=3D"">http://w3ctag.github.io/client-certificates/</a><br = class=3D""><br class=3D""></div><div class=3D"">Thus, it makes sense to = hold off and deprecate <keygen> after the fall of this year, when = Web Authentication is deployed in browsers. As stated earlier, the = "WebID" community can simply use Web Authentication rather than client = certs for authentication. <br class=3D""><br class=3D"">That being said, = since the only browser that supports <keygen> currently is = Mozilla, who plans to deprecate regardless of what the TAG says, then it = can also be justified to remove from the standard today as there is no = interoperability. <br = class=3D""></div></div></div></div></div></blockquote><div><br = class=3D""></div><div>As someone who studied philosophy (and not = cryptography) you should be aware of the power of = reasoned</div><div>discussion to change people's points of view. = Certainly new facts on the ground should when relevant</div><div>change = one's behavior.</div><div><br class=3D""></div><div>And there is a lot = that is changing in this space, including improvements to TLS = client certificate authentication </div><div>for HTTP2.0 as for = example the RFC proposal by Mozilla and Microsoft, whose most recent = draft was just</div><div>published a little over a week = ago:</div><div><br class=3D""></div><div> <a = href=3D"https://tools.ietf.org/html/draft-bishop-httpbis-http2-additional-= certs-01" = class=3D"">https://tools.ietf.org/html/draft-bishop-httpbis-http2-addition= al-certs-01</a></div><div><br class=3D""></div><div>So as you see TLS = client certificates is continuously being worked on by top = cryptographers, who</div><div>most certainly are not "home brewed", but = active members of the W3C which you are meant to</div><div>represent. = </div><div><br class=3D""></div><div><keygen> provides very = important functionality to allow those protocols to work on the = web. </div><div><br class=3D""></div><div>Now perhaps the Work you = are advocating is going to be better that what we currently = have.</div><div>Great. But if so why advocate removing a key feature of = the old system that would make comparison</div><div>of the two = technologies difficult? Why the hurry?</div><div><br = class=3D""></div><div><br class=3D""></div><blockquote type=3D"cite" = class=3D""><div class=3D""><div dir=3D"ltr" class=3D""><div = class=3D"gmail_extra"><div class=3D"gmail_quote"><div class=3D""><br = class=3D""></div><div class=3D""> cheers,<br = class=3D""></div><div class=3D""> = harry<br class=3D""><br class=3D""></div><div class=3D""><br = class=3D""> <br class=3D""></div><blockquote class=3D"gmail_quote" = style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid = rgb(204,204,204);padding-left:1ex"><div class=3D""><div class=3D""></div> <div class=3D"">Cheers,<br class=3D""></div> <div class=3D"">Reto<br class=3D""></div> <div class=3D""><div class=3D""> </div> </div> <div class=3D""> </div> </div> </blockquote></div><br class=3D""></div></div> </div></blockquote></div><br class=3D""></body></html>= --Apple-Mail=_28AD0648-4116-4295-BA65-A958EB0F1FB5--