Subject: [rtcweb] draft-ietf-rtcweb-security-arch Section 5.5: mandatory-to-implement certificate algorithms

From: Bernard Aboba <[email-masked]>
Date: Sat, 17 Jun 2017 18:57:09 -0700

Currently, draft-ietf-rtcweb-security-arch Section 5.5 specifies
mandatory-to-implement (D)TLS ciphersuites.  However, it does not specify
the mandatory-to-implement certificate algorithms.

Issue https://github.com/w3c/webrtc-pc/issues/1258 has been filed against
the WebRTC 1.0 specification Section 4.10, which states:

The following values must be supported by a user agent
<https://rawgit.com/w3c/webrtc-pc/master/webrtc.html#dfn-user-agent>: {
name: "RSASSA-PKCS1-v1_5
<https://w3c.github.io/webcrypto/Overview.html#rsassa-pkcs1>",
modulusLength: 2048, publicExponent: new Uint8Array([1, 0, 1]), hash:
"SHA-256" }, and { name: "ECDSA
<https://w3c.github.io/webcrypto/Overview.html#ecdsa>", namedCurve: "P-256
<https://w3c.github.io/webcrypto/Overview.html#dfn-NamedCurve>" }.
NOTE

It is expected that a user agent
<https://rawgit.com/w3c/webrtc-pc/master/webrtc.html#dfn-user-agent> will
have a small or even fixed set of values that it will accept.

Can this text (or some suitable replacement) be added to
draft-ietf-rtcweb-security-arch?

Bernard Aboba
On behalf of the W3C WEBRTC WG