[whatwg] window.cipher HTML crypto API draft spec
ddahl at mozilla.com
Mon May 23 21:33:06 PDT 2011
The implementation is secondary in this effort. I think I have nailed down an elegant API that web developers can understand and easily use without shooting themselves and others in the foot.
----- Original Message -----
From: "=JeffH" <Jeff.Hodges at KingsMountain.com>
To: whatwg at lists.whatwg.org
Sent: Monday, May 23, 2011 10:14:36 PM
Subject: Re: [whatwg] window.cipher HTML crypto API draft spec
David Dahl replied..
> "Simon Heckmann" <simon at simonheckmann.de> asked..
>> Why does it only handle asymmetric encryption? Something to
>> encrypt/decrypt data with e.g. AES would be nice as well!
> I do need to add a symmetric encryption API as well, my current focus has
> been on the exchange of message between web users, but that is only one
> facet of the results of this effort. I should look at the big picture a bit
> and think about what that API should look like.
Various folks have been thinking about the need to leverage platform crypto
functions (rather than implementing crypto in "JS libraries") via a
standardized API for browser-side web app code such that a
swath of use cases is addressed, here's a couple examples of such position
The Need for a Web Security API
Wanted: Native JS Encryption
Some have noted that there ought to be a very high level API built on top of
such a substrate that web app developers could use for their more common use
cases. Keyczar is one example of such an API <http://www.keyczar.org/>, and
cryptlib is another
Adam Barth replied..
> David Dahl said..
>> Yes, that is the case, I am using NSS. I imagine other browser vendors
>> would also use NSS to implement this.
> It's very unlikely that Microsoft will use NSS to implement this API in IE.
Agreed. We nominally need an API that can be implemented by interfacing with
NSS and CAPI (Microsoft Cryptography API) (arguably as well as OpenSSL, GPG,
fyi/fwiw, another thread from earlier this year cross-posted between this list
and <es-discuss at mozilla.org> noted that there is some discussion amongst the
EcmaScript spec folk about defining an "a real crypto API"..
[whatwg] Cryptographically strong random numbers (Mark Miller)
More information about the whatwg