WebCrypto

[olizilla]

Streaming WebCrypto APIs

• Why: Allow encryption of large files to big to fit into memory.
• Workaround: Manually chunk files before encrypting.
• Discussion: Bug 27755 - Using the Subtle Crypto Interface with Streams w3c/webcrypto#73
• Status: Needs editor 2021-01-29

We need an editor. Not just an editor to lead the spec/architecting decisions about this one feature, but also to look at the 13 other open enhancement requests/proposals

So if anybody following this issue would be like to explore the idea of taking responsibility for editing the spec, please let me know, and I can give you more details about the tasks and level of effort that would be expected and needed.
– w3c/webcrypto#73 (comment)

WebCrypto in non-secure contexts

• Why: New protocols don't get a SecureContext, and so are locked out of using the WebCrypto api.
• Workaround: Use userland crypto, increasing bundle size, and slower operation.
• Discussion: https://groups.google.com/a/chromium.org/forum/#!topic/security-dev/DtOFo51WFMo
• Status: Blocked 2017-01-22 - https://groups.google.com/a/chromium.org/d/msg/security-dev/DtOFo51WFMo/fVlG1p4jAgAJ

I closed the issue as WontFix, as the W3C Web Crypto working group extensively debated this for a number of years, with the resolution in w3c/webcrypto#28 of requiring [SecureContext] in the spec, which is what the W3C advanced to CR and (modulo a special corner case) what Chrome implemented.

[olizilla]

@diasdavid should we focus on userland WASM crypto with streaming apis over WebCrypto. WebCrypto requires spec work and effort to get new protocols marked as SecureContext or made available without a SecureContext, and the current spec position on streaming apis is "roll your own".

[olizilla]

Ok who's up for shepherding the WebCrypto API?

We need an editor...
if anybody following this issue would be like to explore the idea of taking responsibility for editing the spec, please let me know, and I can give you more details about the tasks and level of effort that would be expected and needed.
– w3c/webcrypto#73 (comment)

[autonome]

Are those issues in the original post the only needs? The secure context one seems... quixotic.

Who would our partners be in creating a chorus of changemaking? Who else is chafing at the abandonment of this API?