Sprints: Write Web Crypto "guidance" page

[wbamberg]

Acceptance criteria

Web Crypto guidance page written and reviewed.

Description

The Web Crypto API seems to be rather controversial in the crypto community:

• https://tonyarcieri.com/whats-wrong-with-webcrypto
• https://blog.cryptographyengineering.com/2012/12/28/the-anatomy-of-bad-idea/
• http://lists.w3.org/Archives/Public/public-webcrypto/2012Sep/0186.html

Criticisms seem to fall into a few overlapping areas:

• the API is at the low a level of abstraction, enabling developer to make bad choices about which algorithms to use and how to use them
• deprecated and potentially dangerous algorithms are provided and no guidance is given about this
• providing crypto primitives may encourage web developers to use them in scenarios where they are not appropriate
• especially: crypto in a web browser is challenging because of the highly dynamic way code is delivered to the user's machine, and the possibly different trust alignments ("the program does not represent the user"). So use cases that might make sense in a traditional desktop app environment might be dangerous in the browser.

It would be great to synthesise this into a constructive guide for developers. It would be good to cover things like:

• crypto primitives that should not be used (or should not be used in particular situations, or particular ways) (though this kind of granular stuff should also be included alongside the crypto primitive docs themselves)
• non-crypto risks and problems with security engineering, that the crypto API doesn't help you with (e.g. key management)
• potentially appropriate use cases for the Web Crypto API, and inappropriate ones (and what else you should use instead of the bad ones, e,g, TLS)

I think this would be very useful but difficult to write. It would be a good idea to write it in collaboration with security experts, if we can get help.

[wbamberg]

Closing this for the reasons discussed in https://github.com/mdn/sprints/issues/664#issuecomment-467987010.

[rugk]

Should not you leave it open to wait until you get the assistance of some “crypto people” when writing this?
Or do you think that is not possible to accomplished?

[wbamberg]

Yes, I guess that is fair enough. But I'm not going to be actively working on this in the forseeable future.

[rugk]

…and tag it with "help wanted" (or so?)…

[ExE-Boss]

I don’t think “help wanted” is quite correct in this case.

[Elchi3]

This seems stalled. Closing.