--- a/Overview-UseCases.xml	Fri Nov 30 11:52:12 2012 -0500
+++ b/Overview-UseCases.xml	Wed Dec 05 14:44:57 2012 -0500
@@ -16,7 +16,7 @@
     <meta http-equiv='Content-Type' content='text/html; charset=UTF-8'/>
     <title>Web Cryptography API Use Cases</title>
 
-    <meta name='revision' content='$Id: Overview-FA.xml,v 1.164 2012/10/22 21:58:12 arangana Exp $'/>
+    <meta name='revision' content='$Id: Overview-FA.xml,v 1.164 2012/12/05 14:43:12 arangana Exp $'/>
 
     <link rel='stylesheet' href='FileAPI.css' type='text/css'/>
     <script src='section-links.js' type='application/ecmascript'/>
@@ -32,10 +32,7 @@
 
     <options xmlns='http://mcc.id.au/ns/local'>
       <versions>
-        <cvs href='http://dev.w3.org/2006/webapi/FileAPI/'/>
-        <this href='http://www.w3.org/TR/2012/WD-FileAPI-20121025/' />
-        <previous href='http://www.w3.org/TR/2012/WD-FileAPI-20120712/' />
-        <latest href='http://www.w3.org/TR/FileAPI/' />
+        <cvs href=' http://dvcs.w3.org/hg/webcrypto-usecases'/>
       </versions>
       <editors>
         <person homepage='http://arunranga.com/' email='arun@mozilla.com'>
@@ -53,7 +50,7 @@
     <div class='section'>
       <h2>Abstract</h2>
      <p>
-      This document collates the target use cases for the Web Cryptography API.  These use cases, described as <em>scenarios</em>, represent the set of expected functionality that may be achieved by the Web Cryptography API .  A set of "secondary" functionality may also be documented here as scenarios.
+      This document collates the target use cases for the Web Cryptography API.  These use cases, described as <em>scenarios</em>, represent the set of expected functionality that may be achieved by the Web Cryptography API.  
     </p>
 
 
@@ -133,12 +130,48 @@
       <div id='banking-korea' class='section'>
       <h3>Banking Transactions</h3>
       <p>Park Jae-sang opens up a bank account with Gangnam Bank (GB), and wishes to log-in and engage in online transactions, including account balance checking, online payments (with some automated scheduled payments), and account transfers between domestic and investment accounts.  The first time Park logs in to the GB website with a temporary verification code sent to his cell phone, the bank asks him to ascertain if the browser he is using is not at a kiosk; moreover, he is asked if it is a web browser and machine configuration he will use often.</p>
-      <p>He confirms that it is.  The GB web site then asks him to generate a public key/private key pair, along with a digital certificate.  Park consents, and the web page creates the key pair, storing his private key in the browser's designated key store, along with a one-time key escrow by the bank. [<a href="#derive">DERIVE</a> | <a href="#keyex-dh">KEYEX-DH</a>].</p>
-      <p>Subsequent access to the GB website is triggered via presentation of the key that Park generated when he first accessed the website [<a href="#keycall">KEYCALL</a> | <a href="#decrypt-pki">DECRYPT-PKI</a> | <a href="#sign">??SIGN</a>].  His browser presents this key every time he accesses the website and enters his password, which effectively binds his username and password to the generated private key and certificate.  Additionally, Park can digitally sign online checks, authorize payments, and sign tax forms that he submits to the bank site using this generated key [<a href="#sign">SIGN</a>]. Park can also perform the following tasks:</p>
+      <p>He confirms that it is.  The GB web site then asks him to generate a public key/private key pair, along with a digital certificate.  Park consents, and the web page creates the key pair, storing his private key in the browser's designated key store, along with a one-time key escrow by the bank. Jae-sang is also presented with a user guide that explains the validity period of the certificate, and for how long it will persist.  [<a href="#derive">DERIVE</a> | <a href="#keyex-dh">KEYEX-DH</a>].</p>
+      <p>Subsequent access to the GB website -- always over TLS -- is triggered via presentation of the key and certificate that Jae-sang generated when he first accessed the website.  Along with a username and password, JavaScript initially loaded by GB contains a message that only Jae-sang can decipher, since it is encrypted with his public key.  The message is deciphered, and the deciphered message is then digitally signed and sent back to the GB server.  This establishes identity with non-repudiation.  [<a href="#keycall">KEYCALL</a> | <a href="#decrypt-pki">DECRYPT-PKI</a> ].  
+      <div class="example">
+       <p><div class="ednote">Flesh out this example.</div> </p>
+       <x:codeblock language="es">
+        <span class="comment">/* Assume key retrieval code from IndexedDB that results in prvKeyObjectHandle
+        Assume that if key retrieval is unsuccessful GB provides an alternate process 
+
+
+          */ </span>
+        <span class="comment">// Message generated by GB </span>
+        var cat = "qANQR1DBw04Dk2uPpEjcJT8QD/0VCfFK2XDM5Cg4iTRwmXrB+Pp8SMK5x09WkYqc ";
+        var data = createArrayBuffer(cat);
+        decrypter = window.crypto.createDecrypter("RSAES-PKCS1-v1_5", prvKeyObjectHandle);
+        decrypter.init();
+        decrypter.processData(data);
+        decrypter.complete();
+        decrypter.oncomplete = function(evt){ 
+
+          <span class="comment">// If successfully decrypted send a signed version back</span>
+
+          message = evt.target.result;
+
+          <span class="comment">/* Assume key retrieval code from IndexedDB that results in pubKeyObjectHandle */</span>
+        
+          var signer = window.crypto.createSigner("RSASSA-PKCS1-v1_5", pubKeyObjectHandle);
+          signer.init();
+          signer.processData(message);
+          signer.complete();
+          signer.oncomplete = function(evt){
+            <span class="comment">// sigma.send(evt.target.result, clear) </span>
+            }
+        }
+       </x:codeblock>
+      </div>
+
+      His browser presents this key every time he accesses the website and enters his password, which effectively binds his username and password to the generated private key and certificate.  Additionally, Jae-sing can digitally sign online checks, authorize payments, and sign tax forms that he submits to the bank site using this generated key [<a href="#sign">SIGN</a>]. He can also perform the following tasks, following the authentication cycle describe above:</p>
       <ol>
-        <li><p>Park can receive documents from GB that only he can read.  These include his private bank statements and tax documents. [<a href="#decrypt-pki">DECRYPT-PKI</a> | <a href="#decrypt">DECRYPT</a>]</p></li>
-        <li><p>Park can submit documents to GB that only GB can read, with the assurance that these have come from Park.  Such documents include confidential financial information. [<a href="#encrypt-pki">ENCRYPT-PKI</a>]</p></li> 
+        <li><p>Receive documents from GB via HTTP that only he can read.  These include his private bank statements and tax documents. [<a href="#decrypt-pki">DECRYPT-PKI</a> | <a href="#decrypt">DECRYPT</a>]</p></li>
+        <li><p>Submit documents to GB that only GB can read, with the assurance that these have come from Jae-sing.  Such documents include confidential financial information. [<a href="#encrypt-pki">ENCRYPT-PKI</a>]</p></li> 
       </ol>
+      <p>If GB wishes to "cache" aspects of reusuable authentication code, but cannot avail of a code signing system, GB can employ a similar data integrity mechanism that the <a href="#data-integrity">social networking site uses</a>.</p>
     </div>
     <div id='video-service' class='section'>    
       <h3>Dr. What: Video Service</h3>

--- a/Overview.html	Fri Nov 30 11:52:12 2012 -0500
+++ b/Overview.html	Wed Dec 05 14:44:57 2012 -0500
@@ -12,7 +12,7 @@
     <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
     <title>Web Cryptography API Use Cases</title>
 
-    <meta name="revision" content="$Id: OverviewUseCases.html,v 1.4 2012-11-19 05:50:44 arangana Exp $" />
+    <meta name="revision" content="$Id: Overview-FA.xml,v 1.164 2012/12/05 14:43:12 arangana Exp $" />
 
     <link rel="stylesheet" href="FileAPI.css" type="text/css" />
     <script src="section-links.js" type="application/ecmascript"></script>
@@ -30,16 +30,16 @@
   <link rel="stylesheet" href="http://www.w3.org/StyleSheets/TR/W3C-ED" type="text/css" /></head>
 
   <body>
-    <div class="head"><div><a href="http://www.w3.org/"><img src="http://www.w3.org/Icons/w3c_home" width="72" height="48" alt="W3C" /></a></div><h1>Web Cryptography API Use Cases</h1><h2>W3C Editor’s Draft <em>22 October 2012</em></h2><dl><dt>Latest Editor’s Draft:</dt><dd><a href="http://dev.w3.org/2006/webapi/FileAPI/">http://dev.w3.org/2006/webapi/FileAPI/</a></dd><dt>Latest Published Version:</dt><dd><a href="http://www.w3.org/TR/FileAPI/">http://www.w3.org/TR/FileAPI/</a></dd><dt>Previous Version(s):</dt><dd><a href="http://www.w3.org/TR/2012/WD-FileAPI-20120712/">http://www.w3.org/TR/2012/WD-FileAPI-20120712/</a></dd><dt>Editor:</dt><dd><a href="http://arunranga.com/">Arun Ranganathan</a>, Mozilla Corporation &lt;arun@mozilla.com&gt;</dd><dt>Participate:</dt><dd></dd></dl><p class="copyright"><a href="http://www.w3.org/Consortium/Legal/ipr-notice#Copyright">Copyright</a> &copy; 2012 <a href="http://www.w3.org/"><abbr title="World Wide Web Consortium">W3C</abbr></a><sup>&reg;</sup> (<a href="http://www.csail.mit.edu/"><abbr title="Massachusetts Institute of Technology">MIT</abbr></a>, <a href="http://www.ercim.org/"><abbr title="European Research Consortium for Informatics and Mathematics">ERCIM</abbr></a>, <a href="http://www.keio.ac.jp/">Keio</a>), All Rights Reserved. W3C <a href="http://www.w3.org/Consortium/Legal/ipr-notice#Legal_Disclaimer">liability</a>, <a href="http://www.w3.org/Consortium/Legal/ipr-notice#W3C_Trademarks">trademark</a> and <a href="http://www.w3.org/Consortium/Legal/copyright-documents">document use</a> rules apply.</p></div><hr />
+    <div class="head"><div><a href="http://www.w3.org/"><img src="http://www.w3.org/Icons/w3c_home" width="72" height="48" alt="W3C" /></a></div><h1>Web Cryptography API Use Cases</h1><h2>W3C Editor’s Draft <em>5 December 2012</em></h2><dl><dt>Latest Editor’s Draft:</dt><dd><a href=" http://dvcs.w3.org/hg/webcrypto-usecases"> http://dvcs.w3.org/hg/webcrypto-usecases</a></dd><dt>Latest Published Version:</dt><dt>Editor:</dt><dd><a href="http://arunranga.com/">Arun Ranganathan</a>, Mozilla Corporation &lt;arun@mozilla.com&gt;</dd><dt>Participate:</dt><dd></dd></dl><p class="copyright"><a href="http://www.w3.org/Consortium/Legal/ipr-notice#Copyright">Copyright</a> &copy;  <a href="http://www.w3.org/"><abbr title="World Wide Web Consortium">W3C</abbr></a><sup>&reg;</sup> (<a href="http://www.csail.mit.edu/"><abbr title="Massachusetts Institute of Technology">MIT</abbr></a>, <a href="http://www.ercim.org/"><abbr title="European Research Consortium for Informatics and Mathematics">ERCIM</abbr></a>, <a href="http://www.keio.ac.jp/">Keio</a>), All Rights Reserved. W3C <a href="http://www.w3.org/Consortium/Legal/ipr-notice#Legal_Disclaimer">liability</a>, <a href="http://www.w3.org/Consortium/Legal/ipr-notice#W3C_Trademarks">trademark</a> and <a href="http://www.w3.org/Consortium/Legal/copyright-documents">document use</a> rules apply.</p></div><hr />
 
     <div class="section">
       <h2>Abstract</h2>
      <p>
-      This document collates the target use cases for the Web Cryptography API.  These use cases, described as <em>scenarios</em>, represent the set of expected functionality that may be achieved by the Web Cryptography API .  A set of "secondary" functionality may also be documented here as scenarios.
+      This document collates the target use cases for the Web Cryptography API.  These use cases, described as <em>scenarios</em>, represent the set of expected functionality that may be achieved by the Web Cryptography API.  
     </p>
 
 
-      <div class="ednote"><div class="ednoteHeader">Editorial note</div><p>This is revision $Id: OverviewUseCases.html,v 1.4 2012-11-19 05:50:44 arangana Exp $.</p></div>
+      <div class="ednote"><div class="ednoteHeader">Editorial note</div><p>This is revision $Id: Overview-FA.xml,v 1.164 2012/12/05 14:43:12 arangana Exp $.</p><p>There are 1 further editorial notes in the document.</p></div>
     </div>
 
     <div class="section">
@@ -51,7 +51,7 @@
         report can be found in the <a href="http://www.w3.org/TR/">W3C technical
           reports index</a> at http://www.w3.org/TR/.
       </em></p><p>
-        This document is the 22 October 2012 <b>Editor’s Draft</b> of the
+        This document is the 5 December 2012 <b>Editor’s Draft</b> of the
         <cite>Web Cryptography API Use Cases</cite> specification.
       
       Please send comments about this document to
@@ -146,12 +146,48 @@
       <div id="banking-korea" class="section">
       <h3>3.1. Banking Transactions</h3>
       <p>Park Jae-sang opens up a bank account with Gangnam Bank (GB), and wishes to log-in and engage in online transactions, including account balance checking, online payments (with some automated scheduled payments), and account transfers between domestic and investment accounts.  The first time Park logs in to the GB website with a temporary verification code sent to his cell phone, the bank asks him to ascertain if the browser he is using is not at a kiosk; moreover, he is asked if it is a web browser and machine configuration he will use often.</p>
-      <p>He confirms that it is.  The GB web site then asks him to generate a public key/private key pair, along with a digital certificate.  Park consents, and the web page creates the key pair, storing his private key in the browser's designated key store, along with a one-time key escrow by the bank. [<a href="#derive">DERIVE</a> | <a href="#keyex-dh">KEYEX-DH</a>].</p>
-      <p>Subsequent access to the GB website is triggered via presentation of the key that Park generated when he first accessed the website [<a href="#keycall">KEYCALL</a> | <a href="#decrypt-pki">DECRYPT-PKI</a> | <a href="#sign">??SIGN</a>].  His browser presents this key every time he accesses the website and enters his password, which effectively binds his username and password to the generated private key and certificate.  Additionally, Park can digitally sign online checks, authorize payments, and sign tax forms that he submits to the bank site using this generated key [<a href="#sign">SIGN</a>]. Park can also perform the following tasks:</p>
+      <p>He confirms that it is.  The GB web site then asks him to generate a public key/private key pair, along with a digital certificate.  Park consents, and the web page creates the key pair, storing his private key in the browser's designated key store, along with a one-time key escrow by the bank. Jae-sang is also presented with a user guide that explains the validity period of the certificate, and for how long it will persist.  [<a href="#derive">DERIVE</a> | <a href="#keyex-dh">KEYEX-DH</a>].</p>
+      <p>Subsequent access to the GB website -- always over TLS -- is triggered via presentation of the key and certificate that Jae-sang generated when he first accessed the website.  Along with a username and password, JavaScript initially loaded by GB contains a message that only Jae-sang can decipher, since it is encrypted with his public key.  The message is deciphered, and the deciphered message is then digitally signed and sent back to the GB server.  This establishes identity with non-repudiation.  [<a href="#keycall">KEYCALL</a> | <a href="#decrypt-pki">DECRYPT-PKI</a> ].  
+      <div class="example"><div class="exampleHeader">Example</div>
+       <p><div class="ednote"><div class="ednoteHeader">Editorial note</div>Flesh out this example.</div> </p>
+       <div class="block"><div class="blockTitleDiv"><span class="blockTitle">ECMAScript</span></div><div class="blockContent"><pre class="code"><code class="es-code">
+        <span class="comment">/* Assume key retrieval code from IndexedDB that results in prvKeyObjectHandle
+        Assume that if key retrieval is unsuccessful GB provides an alternate process 
+
+
+          */ </span>
+        <span class="comment">// Message generated by GB </span>
+        var cat = "qANQR1DBw04Dk2uPpEjcJT8QD/0VCfFK2XDM5Cg4iTRwmXrB+Pp8SMK5x09WkYqc ";
+        var data = createArrayBuffer(cat);
+        decrypter = window.crypto.createDecrypter("RSAES-PKCS1-v1_5", prvKeyObjectHandle);
+        decrypter.init();
+        decrypter.processData(data);
+        decrypter.complete();
+        decrypter.oncomplete = function(evt){ 
+
+          <span class="comment">// If successfully decrypted send a signed version back</span>
+
+          message = evt.target.result;
+
+          <span class="comment">/* Assume key retrieval code from IndexedDB that results in pubKeyObjectHandle */</span>
+        
+          var signer = window.crypto.createSigner("RSASSA-PKCS1-v1_5", pubKeyObjectHandle);
+          signer.init();
+          signer.processData(message);
+          signer.complete();
+          signer.oncomplete = function(evt){
+            <span class="comment">// sigma.send(evt.target.result, clear) </span>
+            }
+        }
+       </code></pre></div></div>
+      </div>
+
+      His browser presents this key every time he accesses the website and enters his password, which effectively binds his username and password to the generated private key and certificate.  Additionally, Jae-sing can digitally sign online checks, authorize payments, and sign tax forms that he submits to the bank site using this generated key [<a href="#sign">SIGN</a>]. He can also perform the following tasks, following the authentication cycle describe above:</p>
       <ol>
-        <li><p>Park can receive documents from GB that only he can read.  These include his private bank statements and tax documents. [<a href="#decrypt-pki">DECRYPT-PKI</a> | <a href="#decrypt">DECRYPT</a>]</p></li>
-        <li><p>Park can submit documents to GB that only GB can read, with the assurance that these have come from Park.  Such documents include confidential financial information. [<a href="#encrypt-pki">ENCRYPT-PKI</a>]</p></li> 
+        <li><p>Receive documents from GB via HTTP that only he can read.  These include his private bank statements and tax documents. [<a href="#decrypt-pki">DECRYPT-PKI</a> | <a href="#decrypt">DECRYPT</a>]</p></li>
+        <li><p>Submit documents to GB that only GB can read, with the assurance that these have come from Jae-sing.  Such documents include confidential financial information. [<a href="#encrypt-pki">ENCRYPT-PKI</a>]</p></li> 
       </ol>
+      <p>If GB wishes to "cache" aspects of reusuable authentication code, but cannot avail of a code signing system, GB can employ a similar data integrity mechanism that the <a href="#data-integrity">social networking site uses</a>.</p>
     </div>
     <div id="video-service" class="section">    
       <h3>3.2. Dr. What: Video Service</h3>