diff --git a/index.html b/index.html index afe6bda..bd819e5 100644 --- a/index.html +++ b/index.html @@ -1283,11 +1283,23 @@

Security Considerations

- Pay very close attention to the defense, cryptographic agility, and - political - acceptability of any cryptography you rely on for DID Method security. + Some cryptographic functions are + not allowed on certain government networks, hence it is a + good idea to beware of that when designing a DID Method for use + on those networks.

- + +

+ Some Working + Group wisdom is offered on the limits of cryptographic + agility. Cryptosuites exist so that people that know better + can pick an extremely limited set of options, rather than + enabling a kitchen sink approach. +

+

Avoid complex or slow signature formats, especially if they are poorly documented, or do not have an open standard with well documented test @@ -1307,24 +1319,13 @@

Security Considerations

-

Vendor Lock In

-

- Competition, direct substitutability, interoperability, and mutual - feature support are key to reducing the barriers to adoption of, and - increasing confidence in, your DID Method. -

+

Transparency

Avoid inventing "new features". Work with others to find a common way to express any new features that are not unique to your DID Method.

-

- Avoid hard coupling to specific networks, such as Bitcoin or - Hyperledger Fabric. Design your method such that it may be adapted - to support multiple ledger systems. -

-

Transparency and openness in approaches related to security not only lead to greater security, but promote interoprability and adoption. @@ -1348,15 +1349,14 @@

Digital Signatures

SP 800-56A Rev 3 when evalutating curves for use. + Safecurves does not take into account actual implementation work such as + for secp256k1 in + libsecp256k1, + and has been described as a resource "best considered marketing copy + rather than an earnest attempt at scholarship", in + reviews.

-

Avoid secp256k1, RSA, P-256, P-384 and P-521.

- -

- Avoid relying on smart contracts for complex data management. If you - must use a smart contract, keep it simple and architect a solution - that supports data migration. -