w3c / w3c/webcrypto

problems importing PEM from Httb Bis WGs Signatures 13 draft

Open
#330 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
HTML
Stars
294
Forks
78
PR merge metrics
No merged PRs in 30d

Description

The HTTP WG's draft-ietf-httpbis-message-signatures-13 is in final call. It is publishing the keys it is using in its examples in PEM format.

I am having a particular problem loading the Appendix B.1.2 Example RSA PSS Key with the WebCrypto API. I adapted the import-key example from MDN and attached it here as import-key.zip. The adaptation consists of adding two more keys to the import example giving us a total of three keys:

  1. The first key '0' is the one from the MDN example,
  2. the second '1' is the one that I got to work in v07 and that correctly signs the examples from v13 spec,
  3. the third one is taken directly from the v013 spec. This one throws an exception.

I have opened this as https://github.com/httpwg/http-extensions/issues/2290 .

I prefer the JWK formats as there is no hiding of the data in magical difficult to read formats. But if they are to use PEM can I point them to something that explains what format those PEMs need to have and why the given key (that I have no problem loading in the JVM) does not function with the webcrypto api? Having keys in the spec that load nicely into the browser using the WebCrypto API would help implementers test their code and explain problems by pointing to the spec without needing layers of transformations that may be difficult to explain.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the attached import-key.zip and the MDN Web Crypto import-key example, then compare the three PEM keys described in the issue. Review the linked httpwg/http-extensions issue 2290 to see where the investigation stands; done would mean establishing whether the draft's PEM can be imported through WebCrypto and documenting the required format or limitation.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
cryptography
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.