Plan for X25519 and Chacha20poly1305 implementation? about hpke-js

[dajiaji]

@kdenhartog FYI: Kem:X25519HkdfSha256 and Aead:ChaCha20Poly1305 have been supported.

[kdenhartog]

Ok that's good to know and understandable for simplicity. Especially good for me to get an understanding of your priorities on this project. For me, I don't have an immediate need for it (I could just use one of the other suites at first), but I'd like to ideally be able to use the library in the browser so that I can do some work on making ODoH more generic for any HTTP request and I want to try that out by building a SPA to demo it.

I suspect that the timeline of the X25519/X448 work is still going to take a year at least given that's only a draft report at this point and would expect chacha20poly1305 is going to be even further out for support in browser. Would you be open to using a library like https://github.com/StableLib/stablelib/ when in a browser environment and using those primitives? I'd be willing to add that part as a PR once I need it if so.

[dajiaji]

Would you be open to using a library like https://github.com/StableLib/stablelib/ when in a browser environment and using those primitives?

No problem. I didn't know about stablelib but it looks good, it could be an alternative until the Web Cryptography API supports them. Pull requests are welcome!

[kdenhartog]

Ok sounds good - I'll go ahead and resolve this one for now and when I get around to wanting to switch over to the X25519 implementation I'll follow back up with a PR/issue to get that going. Thanks for the great work on this library and I'm really looking forward to using it!

[dajiaji]

Thank you for considering the use of this library!

Yes, I intend to support X25519/X448. However, at this time I will only support the Node.js environment. If you are planning to use the X25519/X448 only on the Node.js environment, I can change my development plan and prioritize the development of the X25519/X448.

As you probably know, the W3C Web Cryptography API standard does not support the Edwards curves. However, there seems to be a plan to support it (WICG: Secure Curves in the Web Cryptography API), so my original plan was to support X25519/X448 after the support in browsers has progressed.

In addition, I had planned to wait for Web Cryptography API support for ChaCha20/Poly1305 as well.

... however, if the need arises, I may consider supporting all of the HPKE cipher suites using like WASM-enabled primitive cipher implementations. I will consider this after quality improvement of the current implementations and CI environment development for continuous security updates.