SM series algorithms in Web Cryptography

[smx-gotoweb]

Hello TAG!

I'm requesting a TAG review of adding support for SM series algorithms in WebCrypto.

Now the SM series algorithms have been accepted by ISO/IEC and widely used in many industries and fields. That's why we propose to add support for SM series algorithms in WebCrypto, just like RSA, SHA , AES , etc. The relevant information about this feature is listed below :

• Explainer (minimally containing user needs and example code): explainer.md
• Security and Privacy self-review: WebCrypto Self-Review Questionnaire.md
• GitHub repo (if you prefer feedback filed there): webcrypto-sm-series-algorithms
• Primary contacts :
  • @smx-gotoweb
• External status/issue trackers for this feature (e.g. new state): Not yet available

Extended information:

• Refer to the TAG's API Design Principles

We'd prefer the TAG provide feedback as open issues in our GitHub repo for each point of feedback.

[dbaron]

Would you be able to fill out the parts of our current issue template that you omitted?

[hober]

To expand on @dbaron's question, in order to do a review of this work we need to understand its provenance and how you expect it to / hope it will progress along the standards track.

Provenance

• What is your organizational affiliation, @smx-gotoweb?
• What organization or project is driving the design?
• Who is funding this work?

Progression along the standards track

• What is the group in which the incubation/design work on this is being done (or is intended to be done in the future)?
• What is the group in which standardization of this work is intended to be done?

On this last question, and though the Web Cryptography Working Group is closed, my understanding is that "discussion around current and future work for the Web Crypto API should be happening on the public-web-security@w3.org mailing list" (according to the email announcing the WG's closure).

[xfq]

Related issue in the webcrypto repo: https://github.com/w3c/webcrypto/issues/231

[smx-gotoweb]

Thanks for the feedback!

[smx-gotoweb]

Hello TAG!

I'm requesting a TAG review of adding support for SM series algorithms in WebCrypto.

Now the SM series algorithms have been accepted by ISO/IEC and widely used in many industries and fields. That's why we propose to add support for SM series algorithms in WebCrypto, just like RSA, SHA , AES , etc. The relevant information about this feature is listed below :

• Explainer (minimally containing user needs and example code): explainer.md
• Security and Privacy self-review: WebCrypto Self-Review Questionnaire.md
• GitHub repo (if you prefer feedback filed there): webcrypto-sm-series-algorithms
• Primary contacts :
  • smx-gotoweb
• Organization/project driving the design: WebCrypto
• External status/issue trackers for this feature (e.g. new state): Not yet available

Further details:

• I have reviewed the TAG's API Design Principles
• The group where the incubation/design work on this is being done (or is intended to be done in the future): unknown
• The group where standardization of this work is intended to be done ("unknown" if not known): unknown
• Existing major pieces of multi-stakeholder review or discussion of this design: N/A
• Major unresolved issues with or opposition to this design: N/A
• This work is being funded by: N/A

We'd prefer the TAG provide feedback as open issues in our GitHub repo for each point of feedback.

[smx-gotoweb]

This is Shane from browser team of 360. We have implemented the SM series algorithms in 360 browsers since 2017, the latest version is based on Chromium 78. We implemented the SM support mainly in boringssl module. QQ Browser, which is another China browser , claim that hey support the proposal and plan to implement on their futhure product.

[hober]

Hi @smx-gotoweb,

We took a look at this in our teleconference this week.

Though the Web Cryptography Working Group is closed, according to the email announcing the WG's closure) "discussion around current and future work for the Web Crypto API should be happening on the public-web-security@w3.org mailing list." It doesn't look like you've yet taken this proposal to that mailing list for review by Web Crypto API experts. We strongly encourage you to do so.

If, after you've done so and had a chance to update your proposal based on the feedback you receive there, you'd like to come back to us for review, we'd be happy to take another look.