Closed Bug 1038882 Opened 10 years ago Closed 9 years ago

Enable AES-CTR in W3C Web Crypto implementation

Categories

(Core :: DOM: Security, defect)

Product:
Core
Component:
DOM: Security
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED FIXED

People

(Reporter: skamat, Unassigned)

References

Details

(Whiteboard: [WebCryptoAPI]) 

Bug to track Partner request to enable AES-CTR in our implementation.

Reference: 
https://mxr.mozilla.org/mozilla-central/source/dom/crypto/WebCryptoTask.cpp#273 

We already have AES-CTR in our Web Crypto, just need to enable it.
feature-b2g = 2.1
feature-b2g: --- → 2.1
Blocks: 1010743
Hi, Sandip, do you still target to have this in 2.1? No one owns this bug...
Flags: needinfo?(skamat)
This should be owned by Richard and should be on track for 2.2. Richard, pls confirm?
Flags: needinfo?(skamat) → needinfo?(richard)
I think you had the wrong Richard.
Flags: needinfo?(richard) → needinfo?(rlb)
What's the timeline for 2.2?  I'm hoping to enable WebCrypto by default in 34, but it may slip to 35.

The main barrier is that we need to make some review and minor corrections to ensure precise spec compliance (Bug 1037892).  However, if we are willing (for some definition of "we") to live with possibly exposing some minor incompatibilities to the web, it would be possible to flip the switch before we get the spec-compliance bug landed.
Flags: needinfo?(rlb)
(In reply to Richard Barnes [:rbarnes] from comment #5)
> What's the timeline for 2.2?  I'm hoping to enable WebCrypto by default in
> 34, but it may slip to 35.

https://wiki.mozilla.org/RapidRelease/Calendar is what I usually refer to for questions like these.  2.2 will be based off the next even-numbered Gecko release after 2.1 so that means 2.2 will be Gecko 36.  It sounds like that should be fine based on your plans.
Sorry for mis-speaking in comment #3. I meant to say "on track for 2.1" (not 2.2) as Tako is based on 2.1. 

Richard, do you think we should setup a review with partner for what will complete by 2.1 (34)?
(In reply to Andrew Overholt [:overholt] from comment #6)
> (In reply to Richard Barnes [:rbarnes] from comment #5)
> > What's the timeline for 2.2?  I'm hoping to enable WebCrypto by default in
> > 34, but it may slip to 35.
> 
> https://wiki.mozilla.org/RapidRelease/Calendar is what I usually refer to
> for questions like these.  2.2 will be based off the next even-numbered
> Gecko release after 2.1 so that means 2.2 will be Gecko 36.  It sounds like
> that should be fine based on your plans.

I think the release cadence and branch model for 2.2 are under discussion. It could be changed.
(In reply to Sandip Kamat from comment #7)
> Sorry for mis-speaking in comment #3. I meant to say "on track for 2.1" (not
> 2.2) as Tako is based on 2.1. 
> 
> Richard, do you think we should setup a review with partner for what will
> complete by 2.1 (34)?

If we're still not sure about what's required in 2.1 now(the feature implementation stage is going to be finished on 9/2) and also can't find an engineering owner on this, I strongly suggest product team to postpone this feature to later versions of FxOS.
Flags: needinfo?(rlb)
I'm unclear on what's being asked here.  Would it be possible to have a call to educate me early next week?
Flags: needinfo?(rlb)
Hi, Sandip, are you the product manager for this feature? Thank you.
Flags: needinfo?(skamat)
Hi, Candice, did you discuss this with the partner before? Is this on your radar? It looks to me that, we're not sure what's required for this feature.
Flags: needinfo?(cserran)
feature-b2g: 2.1 → 2.2?
(In reply to Kevin Hu [:khu] from comment #12)
> Hi, Candice, did you discuss this with the partner before? Is this on your
> radar? It looks to me that, we're not sure what's required for this feature.

Sorry for the late reply, I believe this was confirmed via email thread that partner requests were confirmed for 2.1 already.
Flags: needinfo?(cserran)
Partner confirmed current implementation OK.
Flags: needinfo?(skamat)
(In reply to Candice Serran (:cserran) from comment #13)
> (In reply to Kevin Hu [:khu] from comment #12)
> > Hi, Candice, did you discuss this with the partner before? Is this on your
> > radar? It looks to me that, we're not sure what's required for this feature.
> 
> Sorry for the late reply, I believe this was confirmed via email thread that
> partner requests were confirmed for 2.1 already.

So, does it mean it's already in 2.1 and we can close this bug? Thanks.
Flags: needinfo?(skamat)
Flags: needinfo?(cserran)
Webcrypto was confirmed done in 2.1 but need confirmation from aoverholt's team
Flags: needinfo?(cserran) → needinfo?(overholt)
(In reply to Sandip Kamat from comment #0)
> Bug to track Partner request to enable AES-CTR in our implementation.
> 
> Reference: 
> https://mxr.mozilla.org/mozilla-central/source/dom/crypto/WebCryptoTask.
> cpp#273 

https://mxr.mozilla.org/mozilla-central/source/dom/crypto/WebCryptoTask.cpp#1425 is the relevant line number today and it looks like gecko's AES-CTR implementation supports ENCRYPT, DECRYPT, WRAPKEY, and UNWRAP usages.

Sandip, is this enough to satisfy the partner's request from comment 0?  Does comment 14 mean we're good to go?
Richard, did you ever get clarity on your question in comment 10?
Flags: needinfo?(overholt) → needinfo?(rlb)
clearing NI to revisit when partner clarifies. (their plans are under review for some time)
Flags: needinfo?(skamat)
Minus it for now. Please nominate it again if it's needed. Thank you.
feature-b2g: 2.2? → ---
AES-CTR has been available for more than a year.

https://hg.mozilla.org/mozilla-central/rev/7ea38414bb31
Status: NEW → RESOLVED
Closed: 9 years ago
Flags: needinfo?(rlb)
Resolution: --- → FIXED
Component: Security → DOM: Security
You need to log in before you can comment on or make changes to this bug.