v151 · security · web crypto

Algorithm Updates in WebCrypto

The Web Cryptography API proposal adds post-quantum and modern algorithms: the NIST-standardised ML-KEM key-encapsulation mechanism and ML-DSA digital-signature scheme, plus the widely-used ChaCha20-Poly1305 AEAD cipher. Five new instance methods — encapsulateBits, encapsulateKey, decapsulateBits, decapsulateKey, and getPublicKey — live on crypto.subtle; the feature-detection method is instead static on the interface object as SubtleCrypto.supports().

concepts

  1. ML-KEM Key Encapsulation

    Generate an ML-KEM-768 key pair, encapsulateBits a shared secret against the public key, then decapsulateBits it back with the private key — and verify byte-for-byte that both peers derived the same quantum-resistant secret.

  2. ML-DSA Post-Quantum Signatures

    Generate an ML-DSA key pair, sign a message, and verify it. Flip a byte of the message or signature and watch verification fail — exercising a lattice-based signature scheme designed to resist quantum attacks.

  3. ChaCha20-Poly1305 AEAD

    Authenticated encryption with the ChaCha20-Poly1305 cipher: encrypt a message with a nonce and associated data, decrypt it, then tamper with the ciphertext, nonce, or AAD and see the Poly1305 tag reject it.

  4. Algorithm Support Probe

    The new static SubtleCrypto.supports(operation, algorithm) method — declared on the SubtleCrypto interface object, not the crypto.subtle instance — answers, synchronously and without a network round trip, whether the browser implements a given algorithm for a given operation. Probe a live matrix across ML-KEM, ML-DSA, ChaCha20-Poly1305, and legacy algorithms.

why it's proposed

A cryptographically relevant quantum computer would break the RSA and elliptic-curve algorithms the web relies on today, and "harvest now, decrypt later" creates a present-tense risk for long-lived secrets. NIST standardised ML-KEM (FIPS 203) for key establishment and ML-DSA (FIPS 204) for signatures; browser-provided implementations can give web apps access without each app shipping a separate WASM cryptography library. ChaCha20-Poly1305 rounds out the set with a widely deployed AEAD that performs well on devices without AES hardware acceleration.

Availability, per the chromestatus API (updated 2026-06-17): developer trial in Chrome 150, origin trial on desktop in Chrome 151–154 with public registration (origin-trial id 1379790335835635713, feature name WebCryptoAdditionalAlgorithms202606). No default-on milestone is recorded yet — status text “Proposed”. This is a proposal with an experimental implementation, not a shipped default.

references