Hi,
Just some question about the status of the specification document where
these new algorithms are defined. As far as I know, the new algorithms
that Chrome is about to ship are not part of the official Web
Cryptography API specification yet. Shouldn't we wait until they are
incorporated to an official specification draft, at least ?
Best,
- javi
On 9/2/26 19:35, Chromestatus wrote:
*Contact emails*
[email protected]
*Explainer*
/No information provided/
*Specification*
https://wicg.github.io/webcrypto-modern-algos
*Summary*
Add post-quantum cryptography and a common symmetric AEAD to the set
of cryptographic algorithms available in the Web Cryptography API.
This will enable developers to have access browser-provided
implementations of common quantum-resistant cryptographic algorithms
standardized by NIST. * ML-KEM - 768, 1024 * ML-DSA - 44, 65, 87 *
ChaCha20-Poly1305 * X-Wing
*Blink component*
Blink>WebCrypto
<https://issues.chromium.org/issues?q=customfield1222907:%22Blink%3EWebCrypto%22>
*Web Feature ID*
web-cryptography <https://webstatus.dev/features/web-cryptography>
*Motivation*
Web Crypto exposes various low-level primitives, however none of the
public/private key cryptography is currently quantum-resistant Adding
quantum-resistant cryptography as a primitive to the existing
WebCrypto APIs allows Javascript cryptography libraries to
automatically use browser-provided cryptography (which may be more
securely implemented and/or backed by a FIPS-validated underlying
library), rather than compiling OpenSSL to WebAssembly or
reimplementing algorithms in pure Javascript (or simply not being
PQC). Many Javascript cryptography libraries fall back to WebCrypto
when it is available—these libraries will now be able to use
BoringSSL-provided implementations instead of pure Javascript
implementations.
*Initial public proposal*
/No information provided/
*TAG review*
/No information provided/
*TAG review status*
Not applicable
*Origin Trial Name*
Additional WebCrypto Algorithms
*Goals for experimentation*
Get a few sites to test out the new algorithms in real-world scenarios
before shipping it, to ferret out any subtle bugs that might've
slipped past us. Ensuring that the algorithms are cryptographically
correct is not as big of a worry (as we're using BoringSSL's
implementation of the crypto). Performance is also not a huge concern,
but it would be good to get this evaluated with in-the-world usage.
*Chromium Trial Name*
WebCryptoAdditionalAlgorithms202606
*Origin Trial documentation link*
https://docs.google.com/document/d/1iFYtR2gab5wDh9DM00BSO8sqPtG6ATWPczmBoD2yLng/edit?usp=sharing
*WebFeature UseCounter name*
kCryptoAlgorithmMlDsa44
*Risks*
*Interoperability and Compatibility*
Won't work cross-browser until other browsers implement any of these
new algorithms.
/Gecko/:
Neutral (https://github.com/mozilla/standards-positions/issues/1282) Despite
being neutral, Firefox is shipping anyway
/WebKit/:
Neutral (https://github.com/WebKit/standards-positions/issues/641) Everyone
is neutral because no one likes the Web Crypto API, but everyone
agrees we should add PQC to it.
/Web developers/: No signals
/Other signals/:
*WebView application risks*
Does this intent deprecate or change behavior of existing APIs, such
that it has potentially high risk for Android WebView-based applications?
None
*Debuggability*
/No information provided/
*Will this feature be supported on all six Blink platforms (Windows,
Mac, Linux, ChromeOS, Android, and Android WebView)?*
Yes
*Is this feature fully tested by web-platform-tests
<https://chromium.googlesource.com/chromium/src/+/main/docs/testing/web_platform_tests.md>?*
Yes
https://wpt.fyi/results/WebCryptoAPI
*DevTrial instructions*
https://docs.google.com/document/d/1iFYtR2gab5wDh9DM00BSO8sqPtG6ATWPczmBoD2yLng/edit?usp=sharing
*Flag name on about://flags*
webcrypto-pqc
*Finch feature name*
WebCryptoPQC
*Rollout plan*
Will ship enabled for all users
*Requires code in //chrome?*
False
*Tracking bug*
https://issues.chromium.org/issues/450627017
*Launch bug*
https://launch.corp.google.com/launch/4463007
*Measurement*
New Methods:
https://chromestatus.com/metrics/feature/timeline/popularity/5830
https://chromestatus.com/metrics/feature/timeline/popularity/5831
https://chromestatus.com/metrics/feature/timeline/popularity/5832
https://chromestatus.com/metrics/feature/timeline/popularity/5833
https://chromestatus.com/metrics/feature/timeline/popularity/5901 New
Algorithms:
https://chromestatus.com/metrics/feature/timeline/popularity/5678,
https://chromestatus.com/metrics/feature/timeline/popularity/5679,
https://chromestatus.com/metrics/feature/timeline/popularity/5680,
https://chromestatus.com/metrics/feature/timeline/popularity/5681,
https://chromestatus.com/metrics/feature/timeline/popularity/5682,
https://chromestatus.com/metrics/feature/timeline/popularity/5683,
https://chromestatus.com/metrics/feature/timeline/popularity/5898,
*Estimated milestones*
Shipping on desktop 154
Origin trial desktop first 151
Origin trial desktop last 154
DevTrial on desktop 150
Shipping on Android 154
Origin trial Android first 151
Origin trial Android last 154
DevTrial on Android 150
Shipping on WebView 154
*Anticipated spec changes*
Open questions about a feature may be a source of future web compat or
interop issues. Please list open issues (e.g. links to known github
issues in the project for the feature specification) whose resolution
may introduce web compat/interop risk (e.g., changing to naming or
structure of the API in a non-backward-compatible way).
/No information provided/
*Link to entry on the Chrome Platform Status*
https://chromestatus.com/feature/5198951632470016?gate=6595848137998336
*Links to previous Intent discussions*
Intent to Prototype:
https://groups.google.com/a/chromium.org/d/msgid/blink-dev/68e95ca2.2b0a0220.2c868e.0000.GAE%40google.com
Ready for Trial:
https://groups.google.com/a/chromium.org/g/blink-dev/c/WKF2N040tGM
Intent to Experiment:
https://groups.google.com/a/chromium.org/d/msgid/blink-dev/6a32a33e.341e3fe1.243138.0c5e.GAE%40google.com
This intent message was generated by Chrome Platform Status
<https://chromestatus.com>.
--
You received this message because you are subscribed to the Google
Groups "blink-dev" group.
To unsubscribe from this group and stop receiving emails from it, send
an email to [email protected].
To view this discussion visit
https://groups.google.com/a/chromium.org/d/msgid/blink-dev/6a985e48.aec07b4f.8d5be.0002.GAE%40google.com
<https://groups.google.com/a/chromium.org/d/msgid/blink-dev/6a985e48.aec07b4f.8d5be.0002.GAE%40google.com?utm_medium=email&utm_source=footer>.
--
You received this message because you are subscribed to the Google Groups
"blink-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion visit
https://groups.google.com/a/chromium.org/d/msgid/blink-dev/4af18616-bcb9-48fc-97f9-35421333cca2%40igalia.com.
