Implementation report for Web Security Context: UI Guidelines

Author

Mary Ellen Zurko <mzurko@us.ibm.com>
Thomas Roessler <tlr@w3.org>

Date

$Date: 2010/05/26 23:27:23 $

This document is an implementation report against the Proposed Recommendation of Web Security Context: User Interface Guidelines. Basic and advanced conformance are defined as in the document's conformance section.

Conformance Statements 10.10

Opera

Whether basic or advanced conformance is claimed (see 3.3 Conformance levels)

Basic

What TLS [SSLv3][TLSv11][TLSv12] protocol versions and algorithms are considered as strong TLS algorithms, and what protocol versions and algorithms are supported in TLS negotiation, but not considered strong.

Supported algorithms: AES 128/256, 3DES, RC4, MD5, SHA-1, SHA-256, SHA-512, 10.x supports SSL v3, TLS 1.0, TLS 1.1 and TLS 1.2, all currently considered strong. This version does not support by default any methods we currently consider inherently weak. There is no support for SSL v2, 40-bit or 56 bit ciphers. There is a possibility to enable support for anonymous DH and the Authentication only ciphers, but these always trigger a warning to the user. We *do* consider RSA, DH and DSA keys shorter than 1000 bits to be weak, and below 900 bits we issue a warning.

In 10.x we have auto-updatable preferences that can trigger warnings for MD5 and SHA-1 in certificates, or disable support completely. The same exist for SSL v3.

What user interface element is the TLS indicator defined in this specification.

padlock in the address bar

What user interface element is the identity signal defined in this specification.

location bar with extra area on the right

What broadly accepted practices are considered sufficient for a trust anchor to be deemed augmented assurance qualified (see 5.1.2 Augmented Assurance Certificates), and what data elements are deemed assured by those certificates.

Extended Validation is the only currently supported AA cert scheme. These are recognized based on certificate policy identifiers coded in the certificate chain, and are only accepted if the Root certificate is associated with the same OID (digitally signed information about this association is downloaded regularly from an online repository).
O= and C= are deemed assured by those certificates.

What features beyond the claimed conformance level the user agent conforms with.

See table below.

Google Chrome 5

Whether basic or advanced conformance is claimed (see 3.3 Conformance levels)

Basic

What TLS [SSLv3][TLSv11][TLSv12] protocol versions and algorithms are considered as strong TLS algorithms, and what protocol versions and algorithms are supported in TLS negotiation, but not considered strong.

TBD

What user interface element is the TLS indicator defined in this specification.

The padlock in the address bar

What user interface element is the identity signal defined in this specification.

The location bar with the extra indicator information

What broadly accepted practices are considered sufficient for a trust anchor to be deemed augmented assurance qualified (see 5.1.2 Augmented Assurance Certificates), and what data elements are deemed assured by those certificates.

WebTrust EV audit, in accordance with CA/B Forum EV guidelines.
O= and C= are deemed assured by those certificates.

What features beyond the claimed conformance level the user agent conforms with.

See table below.

Firefox 3.6

Whether basic or advanced conformance is claimed (see 3.3 Conformance levels)

Advanced

What TLS [SSLv3][TLSv11][TLSv12] protocol versions and algorithms are considered as strong TLS algorithms, and what protocol versions and algorithms are supported in TLS negotiation, but not considered strong.

http://www.mozilla.org/projects/security/pki/nss/nss-3.11/nss-3.11-algorithms.html contains a list of all supported algorithms. symmetric keys smaller than 90 bits and RSA moduli < 768bits are currently regarded as weak.

What user interface element is the TLS indicator defined in this specification.

The padlock in the lower right corner

What user interface element is the identity signal defined in this specification.

The location bar and the area to the left of it.

What broadly accepted practices are considered sufficient for a trust anchor to be deemed augmented assurance qualified (see 5.1.2 Augmented Assurance Certificates), and what data elements are deemed assured by those certificates.

http://www.mozilla.org/projects/security/certs/policy/
O= and C= are deemed assured by those certificates.

What features beyond the claimed conformance level the user agent conforms with.

See table below.

Overview table of supported features