18:03:57 RRSAgent has joined #crypto 18:03:57 logging to http://www.w3.org/2012/11/26-crypto-irc 18:03:59 RRSAgent, make logs public 18:03:59 Zakim has joined #crypto 18:04:01 Zakim, this will be SEC_WebCryp 18:04:01 I do not see a conference matching that name scheduled within the next hour, trackbot 18:04:02 Meeting: Web Cryptography Working Group Teleconference 18:04:02 Date: 26 November 2012 18:23:19 ddahl has joined #crypto 19:00:38 trackbot, start meeting 19:00:40 RRSAgent, make logs public 19:00:42 Zakim, this will be SEC_WebCryp 19:00:42 ok, trackbot; I see SEC_WebCryp()3:00PM scheduled to start in 60 minutes 19:00:43 Meeting: Web Cryptography Working Group Teleconference 19:00:43 Date: 26 November 2012 19:00:44 Zakim, what's the code? 19:00:45 the conference code is 27978 (tel:+1.617.761.6200 sip:zakim@voip.w3.org), hhalpin 19:49:26 virginie has joined #crypto 19:51:06 mountie has joined #crypto 19:52:31 zakim, what conferences do you see? 19:52:31 I see Team_(privacy)19:00Z, T&S_EGOV(Eurasian)4:00AM active 19:52:32 also scheduled at this time are XML_CG()3:00PM, WAI_PFWG(A11Y)3:00PM, RWC_Audio()2:00PM, SEC_WebCryp()3:00PM, WAI_AUWG()3:00PM, XML_QueryWG(fttf)2:00PM 19:54:16 hi 19:54:45 Zakim, this conference will be SEC_WebCryp 19:54:45 ok, virginie; I see SEC_WebCryp()3:00PM scheduled to start in 6 minutes 19:55:20 SEC_WebCryp()3:00PM has now started 19:55:25 am i in right channel? 19:55:27 +ddahl 19:55:48 mountie: yes 19:55:57 agenda+ welcome 19:56:06 ok hi david 19:56:08 hi mountie:) how's SF? 19:56:14 agenda+ mercurial repository 19:56:33 not so cold. good climate 19:56:41 agenda+ Use case (if arun shows up) 19:56:52 mountie: I asked a few mozillians about meeting up with you but never heard back - I saw that you were in contact with Gen, so thats good 19:57:03 agenda+ action list 19:57:12 markw has joined #crypto 19:57:26 + +1.512.257.aaaa 19:57:30 agenda+ how to move forward on key storage 19:57:46 ddahl i don't mind 19:58:03 agenda+ low level API and next working draft 19:58:22 Karen has joined #crypto 19:58:31 agenda+ Group Life 19:58:42 agenda? 19:59:30 + +1.650.525.aabb 19:59:50 pal has joined #crypto 20:00:29 +??P3 20:00:50 wtc has joined #crypto 20:02:19 +??P5 20:02:41 who is on the call ? 20:02:52 zakim, who is on the call ? 20:02:52 On the phone I see ddahl, +1.512.257.aaaa, +1.650.525.aabb, ??P3, ??P5 20:02:59 rsleevi has joined #crypto 20:03:07 zakim, ??P5 is me 20:03:07 +virginie; got it 20:03:17 mountie is online 20:03:22 Zakim, who is on the phone? 20:03:22 On the phone I see ddahl, +1.512.257.aaaa, +1.650.525.aabb, ??P3, virginie 20:03:29 Zakim, aabb is Google 20:03:29 +Google; got it 20:03:43 257.aaaa is probably Karen 20:03:44 +WSeltzer 20:04:00 zakim, i am aabb 20:04:00 sorry, pal, I do not see a party named 'aabb' 20:04:01 + +1.408.540.aacc 20:04:10 Zakim, aacc is Netflix 20:04:10 +Netflix; got it 20:04:23 Zakim, Netflix has markw 20:04:23 +markw; got it 20:04:26 zakim, aabb is pal 20:04:26 sorry, pal, I do not recognize a party named 'aabb' 20:04:53 zakim, who is on the call ? 20:04:54 On the phone I see ddahl, Karen?, pal, ??P3, virginie, WSeltzer, Netflix 20:04:54 Netflix has markw 20:05:28 zakim, who is on the call ? 20:05:28 On the phone I see ddahl, Karen?, pal, Google, virginie, WSeltzer, Netflix 20:05:31 Google has wtc, rsleevi 20:05:31 Netflix has markw 20:05:47 mountie: Are you on the phone? 20:06:24 mountie has joined #crypto 20:06:25 mitchz has joined #crypto 20:06:28 Zakim, Netflix has mitchz 20:06:28 +mitchz; got it 20:07:09 zakim, who is on the call ? 20:07:09 On the phone I see ddahl, Karen?, pal, Google, virginie, WSeltzer, Netflix 20:07:12 Google has wtc, rsleevi 20:07:12 Netflix has mitchz 20:07:58 agenda? 20:08:45 I can be the scribe 20:09:11 chair Virginie 20:09:13 scribe: Wan-Teh 20:09:15 scribenick: wtc 20:10:48 hhalpin has joined #crypto 20:10:53 virginie: the agenda: mercurial repository, use cases, key storage, low-level API, etc. Anyone would like to add something else to the agenda? 20:11:05 virginie: the agenda is approved. 20:11:12 Zakim, what's the code? 20:11:12 the conference code is 27978 (tel:+1.617.761.6200 sip:zakim@voip.w3.org), hhalpin 20:11:17 http://www.w3.org/2012/11/12-crypto-minutes.html 20:11:46 virginie: the minutes of the previous meeting are approved: http://www.w3.org/2012/11/12-crypto-minutes.html 20:11:58 virginie: we can go to the first agenda item. 20:12:09 virginie: mercurial repository' 20:12:15 http://lists.w3.org/Archives/Public/public-webcrypto/2012Nov/0115.html 20:12:49 rsleevi: harry has set up the mercurial repository. It allows the editors and authors to move away from CVS for revision control. 20:13:00 Just tell me if you need any help! 20:13:14 rsleevi: mercurial allows us to post a URL that shows the diffs of a change to the spec. 20:13:42 rsleevi: mercurial also facilitates making incremental (smaller) changes rather than a big change. 20:13:55 virginie: who is able to use it? 20:14:13 virginie: is it just the Editors? Can a member make changes? 20:14:23 Yes, any member can make changes 20:14:24 Non-members can't 20:14:31 but they can follow commits 20:14:33 make sense? 20:15:06 rsleevi: the editors should be responsible for incorporating changes to the documents. 20:15:44 @hhalpin: I suppose the question is "can" and "should". Any member today *can* make changes via CVS, but that hasn't happened 20:15:52 +[IPcaller] 20:16:00 Zakim, [IPcaller] is hhalpin 20:16:00 +hhalpin; got it 20:16:04 hhalpin: any member can make changes. Non-members can't, but they can follow commits. 20:16:14 Thus, the process does not change re editors 20:16:24 If another member of the WG makes changes, we can follow it 20:16:28 and its tracked 20:16:31 so there should be no problems 20:16:36 i.e. the editors can delete changes 20:16:43 if say, a "rogue" member does a commit :) 20:16:51 (apologies, very bad voice connection) 20:16:56 Resolution: The process continues with editors making changes to the spec based on WG consensus 20:17:16 rsleevi: Resolution: The process continues with editors making changes to the spec based on WG consensus [12:17] * rsleevi Zakim, close this agendum [12:17] * Zakim I do not know what agendum had been taken up, rsleevi 20:17:49 http://www.w3.org/2012/webcrypto/track/actions/open 20:17:49 virginie: skipped Use Cases because Arun is not here. 20:18:00 virginie: Action List 20:18:20 ddahl - any idea what happened to Arun? 20:18:21 virginie: does anyone have an action to close? 20:18:30 amorgaut has joined #crypto 20:18:34 hhalpin: unfortuantly, no 20:18:35 http://www.w3.org/2012/webcrypto/track/actions/57 20:19:08 If you need any help re HG, ping me rsleevi 20:19:09 it should just work :) 20:19:16 virginie: what's the status of http://www.w3.org/2012/webcrypto/track/actions/57? 20:19:45 http://www.w3.org/2012/webcrypto/track/actions/open 20:19:52 rsleevi: I already made some edits before the mercurial repository was set up, Will migrate my edits to Mercurial 20:20:28 Note I will delay my blog post item till we publish our second heartbeat in Dec. 20:20:30 virginie: next agenda item: key storage 20:21:02 virginie: we have the proposal from Mark Watson. 20:21:25 virginie: Mark made it clear that it is important for Netflix to have key storage. 20:21:55 virginie: But the privacy concerns must be considered and addressed. 20:21:58 keystorage is also important in Korea UseCase. 20:22:17 mountie: keystorage is also important in Korea UseCase. 20:22:48 q+ 20:22:52 virginie: this issue is difficult to resolve and make progress on. 20:23:14 q+ 20:23:24 virginie: issues: key discovery, key import, and privacy 20:23:52 Note that "key import/export, a common method for accessing and defining properties of keys" is a secondary feature 20:23:59 but obviously, lots of folks want key import/export. 20:24:02 virginie: I would like the parties involved to work together on this. 20:24:25 q+ 20:24:35 virginie: would it be OK to work together, with more time (say, two months), on this? 20:24:55 agree. need to work more. 20:25:10 hhalpin: I just wanted to point out "key import/export, a common method for accessing and defining properties of keys" is a secondary feature 20:25:34 hhalpin: I don't want it to delay our progress on the first version. 20:25:37 q+ 20:25:46 we need to list up every available issues related keyStorage. 20:26:21 My concern is that we will not 1) respond to reviews from first draft and 2) we need to cover primary features by mid-Dec. 20:26:29 hhaplin: (quality of the voice connection was poor so the scribe may not have fully captured his words) 20:26:47 I am just wondering if rsleevi thinks we can still do a second heartbeat 20:26:51 hhalpin: My concern is that we will not 1) respond to reviews from first draft and 2) we need to cover primary features by mid-Dec. 20:26:52 that covers the above 20:27:11 hhaplin: I am just wondering if rsleevi thinks we can still do a second heartbeat that covers the above 20:27:37 rsleevi: our proposal has been that the spec does not address key storage. 20:28:26 rsleevi: we define the key object but don't define where the key objects come from. This is consistent with other W3C APIs such as the File API and WebGL. 20:29:06 rsleevi: our proposal has been to take any proposal for key storage as a separate proposal due to the WG charter and timeline. 20:29:44 rsleevi: to clarify, I see the key storage as a separate specification. It doesn't need to be part of the core API, 20:29:47 is this the current charter? -> http://www.w3.org/2011/11/webcryptography-charter.html 20:29:53 -WSeltzer 20:30:05 q+ 20:30:12 I know the keystorage will not be addressed in the spec. 20:30:31 rsleevi: the timeline and opportunities for implementors to experiment with different methods of implementation are the reasons. 20:30:33 but I need to know how keyStorage is secured. 20:30:41 Primary API Features [...] key storage and control beyond the lifetime of a single session 20:30:46 q? 20:31:36 markw: key import and export are necessary for access to pre-provisioned keys. 20:32:16 +WSeltzer 20:32:30 Yes, but that "key storage and control beyond the lifetime of a single session" is handled by structured clone, if that's what the WG wants 20:32:40 markw: we understand pre-provisioned keys to be in the API. We object to removing support for pre-provisioned keys (by removing the key storage API). 20:33:05 q+ 20:33:22 markw: I understand from rsleevi that Google isn't interested in working on that. I think we should let parties interested in that feature to work on that. 20:33:44 I mean, we could branch things out into different specs, vote, etc. 20:34:07 markw: whether this (key discovery) would be a separate document depends on the timeline. 20:34:08 There are no process problems with a separate document I believe, although it may not be Rec-track. 20:34:13 -WSeltzer 20:34:31 markw: but I happen to believe we can get it done within the timeframe. 20:34:32 Its hard to change Rec Track docs due to IP commitements to charter, but Working Group Notes are always possible 20:34:59 Another possibility is to work it out in a separate document and then bring the document at a later point to the WG. 20:35:04 pal: just wanted to confirm the charter does list key storage as a primary feature. 20:35:07 q+ 20:35:13 @hhalpin: 'although it may not be Rec-track' would count as a 'process problem', IMO 20:35:23 pal: wanted to understand the reluctance to support it. 20:36:37 hhalpin: (explained the the charter (the initial draft) but the voice was barely intelligible) 20:37:02 +WSeltzer 20:37:05 Harry: really difficult to understand you 20:37:30 As I said, key storage means putting keys in local storage 20:37:45 pal: I heard some statement that key storage is not primary work. I just wanted to point out the charter states in plain English that it is in the primary features. 20:37:54 -hhalpin 20:38:08 hhalpin: key storage means putting keys in local storage 20:38:15 q+ 20:38:29 ack hhalpin 20:38:55 rsleevi: providing a structure clone algorithm using existing storage mechanism such as Indexed DB meets the "key storage" requirement in the WG charter. 20:39:17 rsleevi: "key storage" as in secure elements and smart cards is out of scope. 20:39:26 hhalpin_ has joined #crypto 20:39:54 Note that key storage is covered by localStorage/structured clone technically, but again, hoping we can get something more sophisticated 20:39:55 rsleevi: I'm trying to provide an incremental solution in the API based on our timeline. 20:40:19 q? 20:40:53 virginie: when we wrote the charter, we said we would not write anything that is secure element specific. 20:41:05 Zakim, what's the code? 20:41:05 the conference code is 27978 (tel:+1.617.761.6200 sip:zakim@voip.w3.org), hhalpin_ 20:41:36 markw: both the key storage and pre-provisioned keys are in the first public working draft. 20:41:44 q+ 20:41:51 markw: the Lyon meeting was the first time anyone proposed to have them removed from the API. 20:41:57 ack markw 20:41:58 +[IPcaller] 20:42:01 +[Microsoft] 20:42:08 Zakim, [IPcaller] is hhalpin 20:42:08 +hhalpin; got it 20:42:11 q+ 20:42:36 markw: smart cards (not origin specific) are a different problem from pre-provisioned keys in the first public working draft. 20:42:52 markw: we should try to address the technical issues. 20:42:56 zakim, close the queue 20:42:56 ok, virginie, the speaker queue is closed 20:43:19 My belief is that we need to prioritize the second heartbeat requirements 20:43:26 for the next few weeks 20:43:38 and that in makes sense however to revisit 20:43:57 the key storage questions (and import/export variations, which to me seem rather sensible as proposed by MarkW) 20:44:05 after the second heartbeat, and go for these on the third heartbeat 20:44:11 and see if we can get consensus 20:44:18 ddahl: in the high-level API we could use a local storage. I can see we need some kind of key ID that is implicitly drawing from some kind of key storage mechanism, however... 20:44:25 q? 20:44:31 ack ddahl 20:45:20 tentative of resolution : the pre-provision key topic will be adressed in separate specification 20:45:32 hhalpin_: you are voiping bad 20:45:35 In IRC 20:45:49 hhalpin: the WG, the people who are interested in key storage and pre-provisioned keys (the voice connection was broken...) 20:46:16 + 20:46:18 q+ 20:46:20 q+ 20:46:23 virginie: markw, what would you put to support pre-provisioned keys? 20:46:40 PROPOSAL: Pre-provisioned keys and key import/export addressed in second document and interested WG members can work on it, and we revisit after second heartbeat once primary features are covered. 20:46:40 The reason is we obviosly don't have consensus! 20:46:49 I.e. the editor and one implementer (Google) object 20:47:14 hhalpin: the reason for proposing this be a separate document is we obviosly don't have consensus! 20:47:21 revisit = try to get consensus again 20:47:33 well, there are details we have to discuss first ... 20:47:58 the idea is that folks in the WG should not be blocked from making progress on their proposal due to current objections 20:48:36 Normative documents need to track on same timeline, non-normative do not. 20:48:45 microsoft: if the reason is the schedule, would the separate document tracking the same time line, would it divide the work? 20:48:50 in the high level API I can see where we will need to specify private keys via an ID generated via a generate key API. The storage is implicit and I will imagine the browser will have to provide a management interface to handle key deletion, etc. There would be no additional API to manage keys, import/export, etc 20:48:58 i.e. different document would track to same timeline if we get consensus on it, otherwise it does not matter. 20:49:07 virginie: we have some motivated people... 20:49:27 hhalpin: different document would track to same timeline if we get consensus on it, otherwise it does not matter. 20:49:35 The W3C does work by consensus, but we want people to make progress. 20:49:55 virginie: the problem is that most of the people who want this feature think it is a primary feature. 20:49:55 q- 20:50:02 ack hhalpin_ 20:50:20 PROPOSAL: Pre-provisioned keys and key import/export addressed in separet document and interested WG members can work on it, and will be worked in parallel 20:50:45 q+ 20:50:57 Note: We're very interested in this feature, but think that minimally the scope and use cases are clearly more than just Netflix's use cases, and thus potentially require a separate timeline. But +1 to separate document for separate discussion 20:51:26 The problem is that the main document needs to reflect current consensus 20:51:49 PROPOSAL: Pre-provisioned keys and key import/export addressed in separate document and interested WG members can work on it, and will be worked in synchonisation 20:52:19 markw: what we didn't want to see is to remove something from the first public working draft and move it to a second document. I still don't see why we can't just address the technical issues. 20:52:20 Because document we have needs to reflect consensus and this proposed feature has an objection. 20:52:41 PROPOSAL: Pre-provisioned keys and key import/export addressed in separate document and interested WG members can work on it, and will be worked in synchronisation 20:52:43 hhalpin: Because document we have needs to reflect consensus and this proposed feature has an objection. 20:53:15 +1 20:53:41 rsleevi: we've been from the start very interested in alternative key storage. 20:54:15 rsleevi: it's not that I'm opposed to the idea. But the timeline and the implementation constraints make this difficult. 20:54:52 rsleevi: we think a separate document to address this is a way to build consensus, while allowing the primary API to make progress and gain implementation experience. 20:55:18 PROPOSAL: Pre-provisioned keys and key import/export will be addressed in separate document and interested WG members can work on it, and will be worked in synchronisation with the low level API 20:55:21 rsleevi: we don't want the primary API to be blocked on this. 20:55:50 MarkW, feel free to salt and pepper the proposal to taste, since you are the main one driving this 20:55:57 @virginie: I would define it as "Key discovery will be expressed in a separate document ..." 20:56:06 markw; the ability to create the key object associated with a pre-provisioned key. 20:56:06 -WSeltzer 20:56:11 @virginie: Import/Export in the primary doc, and storage is already addressed via structured-clone 20:56:12 PROPOSAL: Pre-provisioned keys related features (create key, find a key) will be addressed in separate document and interested WG members can work on it, and will be worked in synchronisation with the low level API 20:56:29 markw: and leave key wrap/unwrap in the main document. 20:56:57 markw: we should agree now that a draft for this document should be created. 20:57:12 PROPOSAL: A draft specification will be created about pre-provisioned keys related features (create key, find a key) and interested WG members can work on it, and will be worked in synchronisation with the low level API 20:57:12 sounds good to me, I can set up another HG repo for this documet. 20:57:35 virginie: PROPOSAL: A draft specification will be created about pre-provisioned keys related features (create key, find a key) and interested WG members can work on it, and will be worked in synchronisation with the low level API 20:57:47 q+ 20:57:56 The group will decide when they have seen the draft whether to remove the material from the main document 20:58:01 Noting we timing we need to do this all before our next hearbeat, i.e. mid-Dec. 20:58:03 markw: The text was already removed per our previous resolution 20:58:19 PROPOSAL: A draft specification will be created about pre-provisioned keys related features (create key, find a key) and interested WG members can work on it, and will be worked in synchronisation with the low level API. Once principle of the draft approved, those features will be removed fofrom Low level API 20:58:22 otherwise we are not 100% clear on the scope of the material that is moving from main draft to new draft 20:58:25 markw: when we see that draft, the WG will decide whether to remove the material from the main document 20:58:56 PROPOSAL: A draft specification will be created about pre-provisioned keys related features (create key object, find a key) and interested WG members can work on it, and will be worked in synchronisation with the low level API. Once principle of the draft approved, those features will be removed fofrom Low level API 20:59:21 -1 20:59:22 Karen: to clarify: "create key" means creating the key object, because the key already exists. 20:59:45 +1 20:59:48 +1 20:59:51 What bit do you disagree with rsleevi? 20:59:56 i.e. the "removed" 21:00:00 or something else? 21:00:01 +1 21:00:05 johnsim_ has joined #crypto 21:00:06 @virginie: The objection is "key discovery" instead of pre-provisioned, and the added text regarding "removing features" was already addressed in a previous resolution 21:01:04 rsleevi: the objection is: "key discovery" instead of pre-provisioned, and the added text regarding "removing features" was already addressed in a previous resolution 21:01:18 rsleevi: so it's procedural. 21:01:19 No, have not agreed to remove KeyStorage 21:01:24 It is in the draft up on the web 21:01:34 There is editors draft and next heartbeat 21:01:46 i.e. "heartbeat" = Working Draft 21:01:48 http://www.w3.org/2012/webcrypto/WebCryptoAPI/#KeyStorage-interface 21:01:52 Working Draft needs to reflect consensus 21:01:57 @virginie: PROPOSAL: A draft specification will be created about key discovery and interested WG members can work on it, and will be worked in synchronisation with the low level API 21:02:00 Editors Draft not necessarily so 21:02:05 How about times for next meeting? 21:02:09 Well, there's certainly no consensus to publish a heartbeat without it, right now 21:02:16 I suggest given things up in the air, we meet next week. 21:02:24 virginie: our next call is the 10th of December, in two weeks. 21:02:29 i agree 21:02:44 virginie: we will address the items we didn't have time to address today. 21:03:00 q+ 21:03:13 We are in a bit of a mess, Virginie, given we need a heartbeat by mid-Dec. 21:03:19 We need to have that doc ready by next call 21:03:23 Rsleevi, do you think that's possible? 21:03:31 -Google 21:03:34 -virginie 21:03:35 -ddahl 21:03:36 -[Microsoft] 21:03:37 -Karen? 21:03:37 -Netflix 21:03:48 @hhalpin: The update? Yes. 21:03:59 -pal 21:04:01 Given a review by Alex Russell as well? 21:04:19 I.e. we need to address 1) Security considerations 2) usability and 3) IRTF comments 21:04:23 hhalpin_: Yes, there's a lot of stuff to propose there 21:04:25 @harry yeap, sorry that we could not adress that topic 21:04:50 hhalpin_: regarding usability, I don't know if we'll have that fully in the next heartbeat 21:05:04 hhalpin_: That obviously requires more discussion than we've had thus far :) 21:05:07 rsleevi, if you get Alex's comments in, I can also run it by Robin Berjon etc. 21:05:10 harry, ryan, david d, what do you think about a call to define what is feasible for our next heartbeat ? 21:05:25 yes, the problem is that this KeyStorage discussion continously distracts us from primary features 21:05:25 I have made the request to generate http://www.w3.org/2012/11/26-crypto-minutes.html rsleevi 21:05:41 I think we should at least do a call next week with the editors to prepare for the next heartbeat 21:05:47 trackbot, end meeting 21:05:47 Zakim, list attendees 21:05:47 As of this point the attendees have been ddahl, +1.512.257.aaaa, +1.650.525.aabb, virginie, wtc, rsleevi, WSeltzer, Karen?, +1.408.540.aacc, markw, pal, mitchz, hhalpin, 21:05:50 ... [Microsoft] 21:05:55 RRSAgent, please draft minutes 21:05:55 I have made the request to generate http://www.w3.org/2012/11/26-crypto-minutes.html trackbot 21:05:56 RRSAgent, bye 21:05:56 I see no action items