1021601 - Remove SHA-224 support from WebCrypto API

Status: RESOLVED FIXED

(Core :: DOM: Security, defect)

Description

[Tim Taubert [:ttaubert] (inactive)]

SHA-224 support has been removed from the spec:

https://dvcs.w3.org/hg/webcrypto-api/rev/3f7df730b2c7

Comment 1

[Tim Taubert [:ttaubert] (inactive)]

Attachment: 0002-Bug-1021601-Remove-SHA-224-support-from-WebCrypto-AP.patch

I based this off of bug 1020882.

Comment 2

[Richard Barnes [:rbarnes]]

Comment on attachment 8435657 [details] [diff] [review]
0002-Bug-1021601-Remove-SHA-224-support-from-WebCrypto-AP.patch

Review of attachment 8435657 [details] [diff] [review]:
-----------------------------------------------------------------

Just to be clear: I'm OK removing this hash function, but it is not true in general that we have to be limited to the algorithms listed in the spec.  If we had some reason to support, say, RIPEMD-160, we should not feel constrained by the fact that it's not in the spec.

Comment 3

[Dana Keeler (she/her) [:keeler]]

Comment on attachment 8435657 [details] [diff] [review]
0002-Bug-1021601-Remove-SHA-224-support-from-WebCrypto-AP.patch

Review of attachment 8435657 [details] [diff] [review]:
-----------------------------------------------------------------

I couldn't seem to find tests for if webcrypto is given a hash algorithm it doesn't support - we should add some.

Comment 4

[Tim Taubert [:ttaubert] (inactive)]

(In reply to Richard Barnes [:rbarnes] from comment #2)
> Just to be clear: I'm OK removing this hash function, but it is not true in
> general that we have to be limited to the algorithms listed in the spec.  If
> we had some reason to support, say, RIPEMD-160, we should not feel
> constrained by the fact that it's not in the spec.

Right, I'm not totally familiar with the spec yet, thanks for clarifying!

(In reply to David Keeler (:keeler) [use needinfo?] from comment #3)
> I couldn't seem to find tests for if webcrypto is given a hash algorithm it
> doesn't support - we should add some.

Yes, we should.

Comment 5

[Tim Taubert [:ttaubert] (inactive)]

(In reply to David Keeler (:keeler) [use needinfo?] from comment #3)
> I couldn't seem to find tests for if webcrypto is given a hash algorithm it
> doesn't support - we should add some.

Actually, bug 1020882 that I just landed contains a test for that.

Comment 6

[Tim Taubert [:ttaubert] (inactive)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/3efccd28317b

Comment 7

[(PTO June 19-July 7) Ryan VanderMeulen]

https://hg.mozilla.org/mozilla-central/rev/3efccd28317b