Security/CryptoEngineering

From MozillaWiki
< Security
Revision as of 18:10, 30 August 2017 by Jcjones (talk | contribs) (→‎Web Authentication: Schedule update)
Jump to navigation Jump to search

Last Updated: 3 Jan 2017

Crypto Engineering Projects

Our team's major projects are broken down by module:

NSS

NSS is the cryptography and transport security library that powers Firefox.

  • 2017 Q2: [MWOS] Add new NSS demonstration code to show how to use NSS in a modern way.
  • 2017 Q2: [MWOS] Implement Argon2 to provide a basis to modernize the Master Password in Firefox.
  • 2017 Q2: Implement hardware crypto accelerations on OSX and ARM
  • 2017 Q3: Integrate BoGo's integration tests into NSS builds.
    • The automated tests for NSS are mostly unit tests. Integration testing was historically assumed to happen at Firefox, but that's limited. BoGo is a rich set of integration tests that can diagnose protocol issues during automated testing.
  • 2017 Q4: Post-Quantum Research and Development.
    • Mozilla is intending to join the efforts in developing cryptography that will remain secure once quantum computers come online. This is expected to be a long-duration R&D effort.

PSM

PSM performs the business logic of deciding whether a given secure network connection is actually trustworthy. It applies logic from the user's choices, the Mozilla Root Program, and the platform in order to make a trust determination. E.g., whether to show a connection as secure.

  • 2016 Q4 / 2017 Q1: Re-architect PSM/NSS interaction to eliminate shutdown crashes.
    • The interaction between PSM and NSS is extremely old, and doesn't follow the modern methods Gecko uses to initialize and shutdown modules. As such, NSS sometimes crashes when shutting down; this is a leading crash on Android. Fixing this is a substantial architectural change.
    • Details here: Platform Use of NSS
  • 2017 Q2: Speed up TLS handshakes
  • 2017 Q2: Continue work on our Certificate Transparency implementation and test infrastructure
  • 2017 Q3: Move error-string formatting for our error pages into the front-end JavaScript
  • 2017 Q3: Retool the "See more" sections of error pages using JavaScript to provide more help

Web Authentication

Password authentication is known to be a security liability on the Web. The W3C Web Authentication Working Group is developing a specification for using Scoped Credentials to supplement or replace passwords. Mozilla intends to implement Web Authentication (WebAuthn) specification.


All of the above dates are for landing in Firefox Nightly.

Goal: permit use of U2F tokens via a user-controllable preference (not on by default) in Firefox 56 or 57, and Web Authentication (on by default) in Firefox 57 or 58. (See RapidRelease/Calendar)

Unstable Build: 30 August 2017

This build contains all of the above patches for Bug 1380270, Bug 1388843, Bug 1388851, and Bug 1245527. It also generally has some small fixups that will also make it somewhere or other.

Enabling debugging (example for OSX): 

  MOZ_LOG="webauthnmanager:5, webauth_u2f:5, webauth_u2f:5, u2fkeymanager:5, u2fhidtoken:5, u2fmanager:5" ~/Desktop/NightlyDebug.app/Contents/MacOS/firefox

This build supports WebAuthn WD-05 and U2F v1.1 using hardware tokens. It has been tested at:

It does not work on Facebook; there are issues beyond browser detection that haven't been analyzed yet.

DOM Security

Retrieved from "https://wiki.allizom.org/index.php?title=Security/CryptoEngineering&oldid=1179625"