Consider using Integrity Control

[simoneonofri]

This issue refers to the security review requested in this issue w3c/vibration#49

Evaluate the use of Integrity control such as SRI, to guarantee Integrity of external resources.

[nigelmegitt]

We currently allow length to be specified e.g. in <data> and that seems to fit within the TTWG membership's comfort zone - note also that SRI didn't exist when we added that feature, and we could not normatively reference it in its current (and recent) FPWD state anyway.

However it looks like there is strong backing for SRI, so it may be available for referencing soon. The right place to add support for SRI would probably be TTML2, however DAPT's provision for permitting foreign vocabulary means that an integrity attribute could be used in DAPT documents with no specification change needed, and implementations that handle it could use it while others would ignore it.

If there is good support for using integrity in DAPT it would also be possible in future to add an extension feature for it and set a disposition level for that feature as appropriate. That would mean that the attribute would no longer be considered foreign vocabulary and use of it for any other purpose would be prohibited.

[simoneonofri]

@nigelmegitt thank you for the comment.

For SRI, we have the level 1 that supports static hashes, the level 2 will support public keys providing more flexibility.

It should be a great addition fin TTML2/DAPT for providing integrity as a security feature.

[nigelmegitt]

@simoneonofri this use case would also be sensitive to the performance characteristics of the static hash function. In the case of DAPT, the player would typically already be playing back audio and video while fetching audio resources and doing time-sensitive client-side mixing and text rendering, which is the kind of real time processor intensive functionality that could be sensitive to additional load, for example having to hash audio clips to check the SRI before playing them.

[simoneonofri]

@nigelmegitt thank you. this is an interesting use-case, cc'ing the SRI-2 editor for this @fbraun

[mozfreddyb]

I'm the SRI editor 👋 , streaming integrity is going to be tricky but something we have wanted to solve for a long while. I think we'll collect use cases to ensure this works out.

In the meantime, web pages are already able to implement their own. If content is already split into multiple assets, those could be fetched and consumed bit-by-bit each with integrity supplied as options to fetch()