Intent to Prototype: Algorithm Updates in WebCrypto

[Chromestatus]

Contact emails

hc...@chromium.org

Explainer

None

Specification

https://wicg.github.io/webcrypto-modern-algos

Summary

Add post-quantum cryptography and a common symmetric AEAD to the set of cryptographic algorithms available in the Web Cryptography API. This will enable developers to have access browser-provided implementations of common quantum-resistant cryptographic algorithms standardized by NIST. * ML-KEM - 768, 1024 * ML-DSA - 44, 65, 87 * ChaCha20-Poly1305

Blink component

Blink>WebCrypto

Web Feature ID

web-cryptography

Motivation

Web Crypto exposes various low-level primitives, however none of the public/private key cryptography is currently quantum-resistant Adding quantum-resistant cryptography as a primitive to the existing WebCrypto APIs allows Javascript cryptography libraries to automatically use browser-provided cryptography (which may be more securely implemented and/or backed by a FIPS-validated underlying library), rather than compiling OpenSSL to WebAssembly or reimplementing algorithms in pure Javascript (or simply not being PQC). Many Javascript cryptography libraries fall back to WebCrypto when it is available—these libraries will now be able to use BoringSSL-provided implementations instead of pure Javascript implementations.

Initial public proposal

TAG review

None

TAG review status

Pending

Risks

Interoperability and Compatibility

None

Gecko: No signal

WebKit: No signal

Web developers: No signals

Other signals:

WebView application risks

Does this intent deprecate or change behavior of existing APIs, such that it has potentially high risk for Android WebView-based applications?

None

Debuggability

None

Is this feature fully tested by web-platform-tests?

No

Requires code in //chrome?

False

Tracking bug

https://issues.chromium.org/issues/450627017

Estimated milestones

No milestones specified

Link to entry on the Chrome Platform Status

https://chromestatus.com/feature/5198951632470016?gate=5112952025907200

This intent message was generated by Chrome Platform Status.