Persistent storage of key
Nobody has claimed this yet.
- Dominant language
- HTML
- Stars
- 294
- Forks
- 78
- PR merge metrics
- No merged PRs in 30d
Description
Hi,
Storing a key at the browser side it already a challenge (especially in webkit--see #245).
In our system in order to overcome this problem, we store the key in a password input field and then it is picked up by the browser's password manager. We then use a similar form to get it back (using browser's autocomplete and user input).
Based on that "trick" I was wondering if Web Crypto spec could pursuit a new "autocomplete" value (e.g., "cryptokey") akin to what WebAuthN is doing (see e.g., here). Then password managers could be leveraged to store private keys, just like the way they store passwords.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reading the Web Crypto specification and the linked WebAuthn autofill guidance, then examine how password inputs and autocomplete values are defined for browser password managers. A complete contribution would need a decided specification change defining the proposed "cryptokey" value and its intended private-key storage behavior.
Written by the indexing model from the issue text.
Assessment
- Domain
- authentication, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100