Memoirs from the outdated internet: The KEYGEN factor

The <keygen/> factor might be one of many weirdest parts ever added to HTML:

<type technique="POST">
  <keygen
    title="key"
    problem="...elective problem string..."
    keytype="RSA" />
  <button kind="submit">Submit</button>
</type>

The aim of the <keygen/> factor was to permit an internet browser to generate a
personal/public keypair upon submitting a type, in a manner that allowed an internet browser
to be enrolled in a brand new consumer certificates.

Anybody who has setup an internet site will respect that SSL/TLS requires an internet
server to have an SSL certificates authenticating its id. Nonetheless, whereas
TLS requires a server certificates, it additionally has elective assist for consumer
certificates, whereby a consumer connecting to a TLS server should additionally
authenticate its id to the server. Simply as within the case of server
certificates, that is executed by presenting a certificates and proving possession of
the corresponding personal key.

Shopper certificates are hardly ever used on the net at this time, although the consumer
certificates performance of TLS is widespread in some non-web contexts¹. But there may be—or was—extra infrastructure
in internet browsers to deal with consumer certificates than many realise. This
infrastructure, and the <keygen/> factor dates again to Netscape 4.0.
Presumably, when cryptographic performance similar to SSL was first being added to
internet browsers, there was considerably extra optimism concerning the viability of
consumer certificates on the net than there may be now.

Why are consumer certificates hardly ever used? There are probably a number of causes, however
most likely the obvious one is that the UI for dealing with them has been really
abysmal. The naked minimal performance and UI for enrolling an internet browser in a
new consumer certificates was added to Netscape 4.0 and appears to have obtained
principally no upkeep or enhancement since.

This unloved characteristic was lastly axed in Firefox 68, launched in 2019, which
eliminated assist for <keygen/>. Chrome has likewise dropped assist. It was
by no means supported by IE. Thus, you possibly can’t use <keygen/> at this time, however this text
will take a look at the way it labored.

How did it work? At its core, the <keygen/> tag is solely a type management,
which is given a title="" attribute like every other type management. A public key
(for instance, an RSA public key) is generated and despatched within the discipline when the
type is submitted, so the server can be taught the online browser’s public key.

The trick, because it had been, is that when the general public secret’s generated and submitted
by the online browser, the corresponding personal secret’s saved in a neighborhood database
by the online browser — certainly, if the personal key had been merely thrown away, there
can be little level.

Typically, the general public key despatched to the server is then utilized by the server to
generate a consumer certificates, which is delivered again to the consumer. The apparent
manner to do that is to redirect the consumer to a web page the place they will observe a hyperlink
to the certificates file, however in precept a consumer certificates may very well be
delivered at this level utilizing another non-web technique.

When the consumer clicks a hyperlink to this X.509 consumer certificates of their browser,
a particular factor occurs: the browser asks if the consumer needs to put in the
consumer certificates. When the browser tries to put in the certificates, it
discovers that it has the corresponding personal key which it saved in a neighborhood
database earlier, when the <keygen/> tag was submitted. This completes the
enrolment course of, and permits the consumer to entry web sites which require a
consumer certificates.

It is fascinating to notice that the personal key saved domestically by the <keygen/>
tag is not seen to the consumer in any of Firefox’s certificates or key administration
UI. So far as I can inform, there isn’t any approach to determine the presence of those
domestically saved personal keys, or delete them.

UI points. The UI points with <keygen/> had been extreme, however most likely the
worst of those happens not even throughout enrolment, however after it. A TLS internet
server can configure itself both to not request a consumer certificates (most
web sites), to request however not require one, or to require one. When visiting a
web site which requests or requires a consumer certificates, Netscape-heritage
browsers would pop up a dialog asking you to decide on what consumer certificates to
use. If the web site requires a consumer certificates however you haven’t any
appropriate ones put in within the browser, the connection would merely fail with
an SSL error display.

Thus, if an internet site had been configured to require a consumer certificates, the UI is
horrible for customers not but enrolled, who get solely an SSL error display. There may be
no alternative for web sites to supply a message like “you haven’t registered
but, go right here”. Since some web site must be out there to new customers to deal with
enrolment, this principally requires you to have two totally different domains — say,
newusers.instance.com and safe.instance.com, with solely the latter
requiring a certificates. In fact, if the consumer by accident loses their
consumer certificates or tries to entry the safe website from a brand new gadget, they
once more get an SSL error which is extraordinarily uninformative and unhelpful.

The UI if an internet site is configured to solely request an elective consumer
certificates isn’t that significantly better. Whereas this enables profitable entry to the
web site for brand new customers, the UI points are much like these of HTTP
authentication; the consumer is prompted to decide on a consumer certificates to ship (if
they’ve one) utilizing a browser-specific UI, and this alternative is then cached. Of
course, most customers will most likely not know what a consumer certificates is, so this
dialog is in itself complicated. Furthermore, this creates a difficulty when the consumer
completes enrolment and needs to alter from not utilizing a consumer certificates
to utilizing a consumer certificates, as (very similar to browsers don’t present any approach to
clear credentials submitted for HTTP authentication) there isn’t any approach to
manually re-trigger the certificates choice dialog, in need of (for instance)
restarting the browser; there isn’t any “logout” mechanism. The identical subject happens
you probably have a number of consumer certificates and need to change between them.

Precise deployment. Precise deployment of consumer certificates authentication
on the net might be discovered principally in inner intranets. Although the
<keygen/> enrolment mechanism has been faraway from browsers at this time, internet
browsers can nonetheless use consumer certificates put in manually.

There was, nevertheless, one real-world deployment of the <keygen/> factor
on a public web site which I keep in mind all too nicely — largely as a result of
of the poor UI made coping with the web site a frequent headache. Particularly,
the certificates authority StartSSL, a part of StartCom.

StartSSL was a CA which constructed its title on gifting away free SSL certificates
when everybody else was charging for them. It was basically a poor man’s Let’s
Encrypt earlier than Let’s Encrypt had even been conceived. It wasn’t doable to
acquire certificates robotically — as an alternative, you had to make use of their web site.
StartSSL had determined to not use usernames and passwords, however consumer
certificates as the premise of authentication to their web site; presumably the
undeniable fact that they had been an SSL firm made them overenthusiastic about adopting
consumer certificates regardless of the horrible UI in internet browsers.

The location used the <keygen/> factor to finish enrolment in a consumer
certificates. When you obtained the certificates, if I recall accurately, you had been
transferred to a different subdomain configured to require a consumer certificates. If
you hadn’t put in the consumer certificates correctly, you bought an SSL error. I
keep in mind coping with this course of going unsuitable usually and having to troubleshoot
Firefox’s consumer certificates dealing with. All in all, the primary factor I took away
from StartSSL’s website is that utilizing consumer certificates for web site
authentication is barely viable even for a extremely technical viewers.
The UI for utilizing and enrolling consumer certificates was principally shipped
in Netscape 4 and by no means modified or improved since, an unloved and forgotten
characteristic. In fact this can be a vicious circle; no one makes use of consumer certificates
because the UI is horrible, and no one spends time bettering the UI as a result of
no one makes use of the characteristic.

By the way, StartSSL was given the CA loss of life penalty in 2016; you can find
the details on Wikipedia.

What does it seem like? I put in Firefox 1.0.8 (launched 2006) underneath Wine
to show <keygen/>:

(Sure, the <blink> factor wasn’t the one circumstance wherein
Netscape-heritage browsers would blink at you! The “please wait” dialog was
probably included because of the considerably longer time key technology would possibly take
again when the characteristic was first carried out. Observe additionally that you could’t even
choose an RSA key measurement higher than 2048 bits.)

See Also

AWS, Azure, GCP and Supabase

After the important thing technology is full, the shape is submitted as regular. The sphere
knowledge submitted for the <keygen/> discipline is a base64-encoded ASN.1 construction
which is described on the MDN
page. This
format is called the Netscape Signed Public Key and Problem (SPKAC) format.
OpenSSL has support for dumping
it, although
considerably peculiarly, it might solely deal with it if offered in Base64-encoded type
prefixed with the string SPKAC=:

$ (echo -n 'SPKAC='; cat take a look at.der | base64 -w 0) | openssl spkac
Netscape SPKI:
  Public Key Algorithm: rsaEncryption
    RSA Public-Key: (2048 bit)
    Modulus:
        00:e2:8b:a3:c2:75:1d:d8:ee:eb:63:4a:8a:3c:f1:
        74:b6:4c:3a:90:bf:c7:eb:d6:6f:0f:e3:78:8f:91:
        b2:62:76:05:d5:cd:80:e5:ec:0a:bc:a0:1b:13:74:
        a1:28:79:8c:f6:4a:4c:1f:87:90:51:50:a0:b6:2e:
        13:a4:50:e0:1d:72:a1:87:ed:93:4c:f5:9b:e1:d9:
        3c:e6:61:30:50:f3:0f:0f:b4:b1:1a:0f:93:8c:54:
        e2:5f:bb:17:30:80:71:d8:bf:da:79:04:e0:20:9f:
        c5:18:bd:1e:42:9e:99:69:5c:22:0e:42:ff:86:8e:
        b8:b0:09:9a:e3:7d:f2:4e:2a:b7:ea:75:84:46:5c:
        3f:a0:60:b6:bb:f0:0c:81:c0:cf:ff:19:bd:18:b4:
        7a:a3:dd:09:55:a9:b7:8f:e3:1c:d5:42:86:e5:ce:
        ee:2nd:80:5b:ef:d4:6c:61:fd:cb:1c:01:b2:02:51:
        e8:38:3a:d3:74:04:13:d2:de:30:83:91:50:3e:51:
        62:fd:e3:59:4e:d4:88:4a:6f:17:5c:4b:51:bd:ff:
        66:df:d1:b7:37:87:02:e9:c1:06:74:38:86:c6:ca:
        c6:53:61:b1:b0:cc:f9:08:fd:95:08:bd:e2:0f:2b:
        41:a6:68:68:e8:2b:5c:13:e6:0e:00:90:26:e1:ef:
        4d:93
    Exponent: 65537 (0x10001)
  Problem String: instance problem string
  Signature Algorithm: md5WithRSAEncryption
      64:c1:e7:2nd:57:c5:57:1d:df:79:45:94:47:c2:31:1f:77:3f:
      a9:f7:b8:78:e1:13:12:5d:2b:0c:89:3d:fd:a6:9b:e7:38:87:
      ee:b9:c9:54:66:29:1c:2c:35:c0:ae:f6:6d:57:d7:6c:2nd:6f:
      ed:83:38:ae:e5:7e:84:a3:35:8a:9c:95:8a:4b:b1:04:a3:37:
      45:09:5f:82:ba:77:7e:4b:f2:a4:41:2e:1f:8a:1c:d9:2f:0b:
      ab:11:6d:fd:87:07:f9:0f:75:advert:28:4f:f9:14:c3:12:10:9e:
      71:8d:a4:59:22:7b:f7:d2:67:86:e3:76:13:31:ef:a9:ce:bb:
      2f:65:cd:b6:2nd:b1:4a:78:38:df:53:f9:d8:17:89:92:9a:1e:
      bf:9e:62:a3:be:85:63:98:22:13:ef:e6:78:f6:ec:a6:9a:35:
      47:30:d9:a9:9a:68:02:1f:f0:37:12:55:e9:b3:6f:8f:07:43:
      5a:5a:a1:99:bb:07:30:58:28:1a:74:9e:1d:42:80:f7:49:8b:
      a5:4d:8e:94:08:cb:be:fa:b9:b5:41:5f:22:f1:f6:ba:3a:a9:
      3d:14:c3:44:10:3d:2e:36:03:99:38:d1:27:39:d9:c3:ca:c9:
      fe:ee:76:9e:ee:c8:40:1e:c8:b7:d7:79:0a:9f:c3:87:53:34:
      b5:1b:7f:e8

The problem string comes from the problem="" attribute of the <keygen/>
factor.

Web Explorer. <keygen/>, like <embed> and <blink>, was a
proprietary tag invented by Netscape, and was by no means supported by IE. As a substitute,
IE required the usage of an ActiveX object by way of JavaScript (new
ActiveXObject("X509Enrollment.CX509EnrollmentWebClassFactory")) to acquire
equal performance.

Present state of affairs. <keygen/> assist has been faraway from all trendy internet
browsers. The MDN
docs present
a great overview of what the factor did. The HTML5 specification briefly
documented
<keygen/>, though it now not does and recommends the usage of the Internet
Cryptography API as an alternative. Round 2011, a proposal for “TLS Origin-Bound
Certificates (OBC)” was floated which was
basically a proposal for a variant of consumer certificates with higher browser
UI as a alternative for cookies, however this by no means noticed huge adoption. It was later
superceded by a “TLS Channel ID”
proposal
which additionally failed to realize adoption.

It’s value noting that TLS consumer certificates fully break company
firewalls which search to “safe” visitors by performing man-in-the-middle
assaults on it. These methods usually work by putting in a rogue CA in
enterprise-controlled finish gadgets to permit for visitors interception. Nonetheless,
the firewall cannot forge a consumer certificates, which is in any case validated by
the web site being related to. Personally I see this as a characteristic², nevertheless it most likely additionally has served to
inhibit additional deployment of consumer certificates.

These days, present efforts to advance the usage of cryptography on the net appear to
be targeted on changing passwords with {hardware} or digital tokens utilizing APIs
similar to WebAuthn. There’s a clear parallel with consumer certificates right here,
being that the necessity for passwords is diminished or eradicated, however because the
characteristic is a topic of contemporary curiosity and growing traits reasonably than an
unloved bygone, it has significantly better UI, usability, and browser assist.

Additional studying. This article by Simon
Tatham offers an
fascinating dialogue about how the performance of the <keygen/> factor
could be emulated in browsers at this time. The WHATWG blog tag for
keygen offers a chronicle of the
abortive effort to standardise <keygen/> and hyperlinks to many mailing listing
discussions that went on throughout this course of, in addition to a writeup of how
<keygen/>
works.