The Web Cryptography API supports the usage of the browsers native cryptograhic functionality through JavaScript, for example a reliable random number generator or the possibility to use different algorithms for encryption or signing.
The spec lists an overview of algorithms as a starting point for implementers, but has the following editorial note added:
Note: All algorithms listed should be considered as "features at risk", barring implementors adopting them. Their inclusion in the Editor's Draft reflects requests for their inclusion by members of the community, and are included as an exercise to ensure the robustness of the API defined in this specification.
As such, the list of algorithms, and the recommendations, may be significantly altered in future revisions.
As far as I understood the idea behind the specification is to provide an interface for cryptography, not write down specific algorithms (which makes totaly sense!).
How do I determine if a client supports a specific algorithm? It is good practice to hide implementation details, but since an algorithm has to have an so called recognized algorithm name I don't understand why you wouldn't want to expose the registered algorithms. Still there is no interface specified and the object where you register the algorithm is described as follows:
This specification makes use of an internal object, [[supportedAlgorithms]].
This internal object is not exposed to applications.
The only possibility to discover available algorithms at the current state would be to catch the NotSupportedError of the subtle interface.
From my point of view the discovery is simple program flow and errors should be handled as an exception, not to implement logic.
Any hints or suggestions? Links to proper w3c-mailinglist discussions are also appreciated.