{"action":"created","issue":{"url":"https://api.github.com/repos/dotnet/designs/issues/11","repository_url":"https://api.github.com/repos/dotnet/designs","labels_url":"https://api.github.com/repos/dotnet/designs/issues/11/labels{/name}","comments_url":"https://api.github.com/repos/dotnet/designs/issues/11/comments","events_url":"https://api.github.com/repos/dotnet/designs/issues/11/events","html_url":"https://github.com/dotnet/designs/issues/11","id":243193136,"number":11,"title":"Security crypto - Roadmap","user":{"login":"karelz","id":5776068,"avatar_url":"https://avatars2.githubusercontent.com/u/5776068?v=4","gravatar_id":"","url":"https://api.github.com/users/karelz","html_url":"https://github.com/karelz","followers_url":"https://api.github.com/users/karelz/followers","following_url":"https://api.github.com/users/karelz/following{/other_user}","gists_url":"https://api.github.com/users/karelz/gists{/gist_id}","starred_url":"https://api.github.com/users/karelz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/karelz/subscriptions","organizations_url":"https://api.github.com/users/karelz/orgs","repos_url":"https://api.github.com/users/karelz/repos","events_url":"https://api.github.com/users/karelz/events{/privacy}","received_events_url":"https://api.github.com/users/karelz/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":49,"created_at":"2017-07-15T18:52:02Z","updated_at":"2017-10-13T00:43:21Z","closed_at":null,"author_association":"MEMBER","body":"We have put together roadmap for Security crypto investments. We present it here for early feedback and further discussion in community.\r\n\r\nThe order is roughly in priority order. To see our release vehicle plans, please check individual issues on CoreFX, linked from below.\r\n\r\n## 1. ASN.1 (DER) reader and writer\r\n\r\n**Tracking:** https://github.com/dotnet/corefx/issues/21833\r\n\r\n**Description:**\r\n  * DER is data encoding format used in PKCS and X509.\r\n  * It's hard to get right (even we had couple of iterations).\r\n\r\n**Business justification:**\r\n  * We see customer ask every 2 weeks on StackOverflow (incl. viable workarounds for other missing features in crypto). Examples:\r\n    * https://stackoverflow.com/questions/41808094/correctly-create-rsacryptoserviceprovider-from-public-key/41835706#41835706\r\n    * https://stackoverflow.com/questions/41232601/uwp-ecdsp-signature/41247153#41247153\r\n    * https://stackoverflow.com/questions/43568189/sign-an-array-of-bytes-with-x509-certificate-in-net-core/43787964#43787964\r\n  * Dependency of other features - we have internal implementation without good (public) API surface. We use it internally (a lot) on Linux and Mac.\r\n\r\n**Cost:** 1-2m\r\n\r\n## 2. Certificate Chain Pinning\r\n\r\n**Tracking:** https://github.com/dotnet/corefx/issues/16364\r\n\r\n**Business justification:**\r\n* Required for multi-tenant scenarios.\r\n\r\n**Cost:** 2w-1m\r\n\r\n## 3. Load RSA, ECDSA, DSA keys from file\r\n\r\n**Tracking:** https://github.com/dotnet/corefx/issues/20414\r\n\r\n**Description:**\r\n* Import RSA, ECDSA, DSA keys from files\r\n\r\n**Business justification:**\r\n * Native Linux scenario. Currently we have workarounds which are Windows-style.\r\n\r\n**Notes:**\r\n* We have internal implementation, without public API.\r\n* Depends on DER feature above.\r\n\r\n**Cost:** 1-2m (partial support 2w)\r\n\r\n## 4. Crypto algorithm AES-GCM, AES-CCM\r\n\r\n**Tracking:** https://github.com/dotnet/corefx/issues/7023\r\n\r\n**Notes:** We need to tweak current crypto API design (doesn't fit these crypto algorithms inputs)\r\n \r\n**Cost:** 2m\r\n\r\n## 5. X509SubjectAlternativeNameExtension\r\n\r\n**Tracking:** https://github.com/dotnet/corefx/issues/22068\r\n\r\n**Description:**\r\n* Expose rich APIs for certificate metadata\r\n\r\n**Business justification:**\r\n* Customers currently use incorrect/incomplete workarounds - parsings ToString() results, which is error-prone e.g. due to localization breaks\r\n\r\n**Cost:** 2w-1m\r\n\r\n## 6. Port crypto algorithm ECDiffieHellman from NetFx\r\n\r\n**Tracking:** https://github.com/dotnet/corefx/issues/8158\r\n\r\n**Description:**\r\n* Port crypto algorithm ECDiffieHellman from NetFX (3.5), Xamarin will benefit as well\r\n\r\n**Business justification:**\r\n* Not commonly used, but when needed, it is very important\r\n* Blocks some migrations to .NET Core from .NET Framework\r\n\r\n**Cost:** 2w-1m\r\n\r\n## 7. Support messaging formats SignedCms & EnvelopedCms\r\n\r\n**Tracking:** https://github.com/dotnet/corefx/issues/14197 & https://github.com/dotnet/corefx/issues/3334\r\n\r\n**Description:** Messaging formats (SignedCms, EnvelopedCms)\r\n\r\n**Business justification:**\r\n* Very popular message formats\r\n\r\n**Notes:**\r\n* We already have Windows-only implementation and Linux prototype, which hit some sort of not-roundtripping-correctly bug with our OpenSSL-based implementation on OSX.\r\n  * Recommendation: Create managed implementation which is consistent across platforms\r\n* Depends on DER feature above\r\n\r\n**Cost:** 2-3m (50% for basic functionality)\r\n\r\n------------------------------------------------------------------------------\r\n\r\nAuthor: @bartonjs\r\n\r\nSuggestions, questions, additional information, or feedback on missing items are all welcome.\r\n\r\nIf anyone is interested in helping with any of the work above, please let us know. We always welcome community contributions."},"comment":{"url":"https://api.github.com/repos/dotnet/designs/issues/comments/336319252","html_url":"https://github.com/dotnet/designs/issues/11#issuecomment-336319252","issue_url":"https://api.github.com/repos/dotnet/designs/issues/11","id":336319252,"user":{"login":"onovotny","id":1427284,"avatar_url":"https://avatars2.githubusercontent.com/u/1427284?v=4","gravatar_id":"","url":"https://api.github.com/users/onovotny","html_url":"https://github.com/onovotny","followers_url":"https://api.github.com/users/onovotny/followers","following_url":"https://api.github.com/users/onovotny/following{/other_user}","gists_url":"https://api.github.com/users/onovotny/gists{/gist_id}","starred_url":"https://api.github.com/users/onovotny/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/onovotny/subscriptions","organizations_url":"https://api.github.com/users/onovotny/orgs","repos_url":"https://api.github.com/users/onovotny/repos","events_url":"https://api.github.com/users/onovotny/events{/privacy}","received_events_url":"https://api.github.com/users/onovotny/received_events","type":"User","site_admin":false},"created_at":"2017-10-13T00:43:21Z","updated_at":"2017-10-13T00:43:21Z","author_association":"MEMBER","body":"@bartonjs Came across a limitation in SignedCms's API as it exists today -- there's no way to do the signing in an extensible way.\r\n\r\nThe specific example is that we need to use Key Vault's API to do the signing of the digest and return the signed bytes. What we need is the input byte array, the hash algo, some state (where we can pack in things like the key vault name, cert name, etc). We can then implement a something that calls the KV SignAsync API and returns the bytes.\r\n"}}
{"actor":{"display_login":"onovotny"}}