problems importing PEM from Httb Bis WGs Signatures 13 draft
Nobody has claimed this yet.
- Dominant language
- HTML
- Stars
- 294
- Forks
- 78
- PR merge metrics
- No merged PRs in 30d
Description
The HTTP WG's draft-ietf-httpbis-message-signatures-13 is in final call. It is publishing the keys it is using in its examples in PEM format.
I am having a particular problem loading the Appendix B.1.2 Example RSA PSS Key with the WebCrypto API. I adapted the import-key example from MDN and attached it here as import-key.zip. The adaptation consists of adding two more keys to the import example giving us a total of three keys:
- The first key '0' is the one from the MDN example,
- the second '1' is the one that I got to work in v07 and that correctly signs the examples from v13 spec,
- the third one is taken directly from the v013 spec. This one throws an exception.
I have opened this as https://github.com/httpwg/http-extensions/issues/2290 .
I prefer the JWK formats as there is no hiding of the data in magical difficult to read formats. But if they are to use PEM can I point them to something that explains what format those PEMs need to have and why the given key (that I have no problem loading in the JVM) does not function with the webcrypto api? Having keys in the spec that load nicely into the browser using the WebCrypto API would help implementers test their code and explain problems by pointing to the spec without needing layers of transformations that may be difficult to explain.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the attached import-key.zip and the MDN Web Crypto import-key example, then compare the three PEM keys described in the issue. Review the linked httpwg/http-extensions issue 2290 to see where the investigation stands; done would mean establishing whether the draft's PEM can be imported through WebCrypto and documenting the required format or limitation.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- cryptography
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100