denoland / denoland/std

Secure Curves in the Web Cryptography API - secp256k1, X25519, X448, Ed25519, Ed448

Open
#4,224 6 comments 0 reactions 0 assignees View on GitHub
crypto suggestion
Dominant language
TypeScript
Stars
3.6k
Forks
681
PR merge metrics
No merged PRs in 30d

Description

**Is your feature request related to a problem? Please describe.**

The current Web Cryptography API lacks support for Secure Curves such as`secp256k1`, `X25519`, `X448`, `Ed25519`, `Ed448`, which are essential for robust cryptographic operations. This limitation restricts the API's utility in scenarios requiring advanced security, such as in the implementation of certain modern cryptographic protocols like [Signal's X3DH Key Agreement](https://signal.org/docs/specifications/x3dh/) protocol for example.

**Describe the solution you'd like**

I propose the integration of Secure Curves into the Web Cryptography API, as outlined in the WICG draft (https://wicg.github.io/webcrypto-secure-curves/). This addition would enhance the cryptographic capabilities of the API, allowing developers to leverage these advanced curves for more secure and efficient cryptographic operations.

The following curves are currectly not available:

[x25519](https://wicg.github.io/webcrypto-secure-curves/#x25519) - The "X25519" algorithm identifier is used to perform key agreement using the X25519 algorithm specified in [[RFC7748](https://wicg.github.io/webcrypto-secure-curves/#bib-rfc7748)].

[x448](https://wicg.github.io/webcrypto-secure-curves/#x448) - The "X448" algorithm identifier is used to perform key agreement using the X448 algorithm specified in [[RFC7748](https://wicg.github.io/webcrypto-secure-curves/#bib-rfc7748)].

[ed25519](https://wicg.github.io/webcrypto-secure-curves/#ed25519) - The "Ed25519" algorithm identifier is used to perform signing and verification using the Ed25519 algorithm specified in [[RFC8032](https://wicg.github.io/webcrypto-secure-curves/#bib-rfc8032)].

[ed448](https://wicg.github.io/webcrypto-secure-curves/#ed448) - The "Ed448" algorithm identifier is used to perform signing and verification using the Ed448 algorithm specified in [[RFC8032](https://wicg.github.io/webcrypto-secure-curves/#bib-rfc8032)].

**Describe alternatives you've considered**

An alternative could be to use third-party libraries that implement Secure Curves. However, this approach may not be as efficient or secure as having native support within the Web Cryptography API itself. Native support ensures standardized implementation and better integration with the web platform.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.