search

ucan-wg / ts-ucan

Auth tokens for a distributed, user-controlled world
https://www.npmjs.com/package/ucans
Apache License 2.0
101 stars 12 forks source link

Support WebCrypto's ECDSA #48

Closed expede closed 2 years ago

expede commented 2 years ago

ECDSA is widely suspected of being "cooked", but it's so widely used that it should be available for those that have use cases and know what they're doing. I'd like to put a warning on it, but as an example, short lived ECDSA UCANs running inside an intranet are probably fine.

@dholms thoughts?

dholms commented 2 years ago

ECDSA -> NIST

Not all ECDSA are suspected of being cooked! For instance: secp256k1.

But yes I think we should support the NIST curves & secp256k1 as next steps :ok_hand:

expede commented 2 years ago

Ah, you're right. The NIST curves are the only ones called "ECDSA" in the WebCrypto API, so I had them too broadly indexed in my brain

secp256k1

Yes, that's a great idea