As of January 2013, what are the potential benefits and drawbacks of the HTML5 Keygen element?
It can improve security when authenticating (in addition to a multi-factor device)
If used as a "client certificate", it can make MITM attacks much more difficult
The Keygen tag is implemented across most non-IE browsers, making it very easy to implement
Works regardless of administrator permission. With IE Active X controls can be disabled and IE and browser settings can make key generation impossible on tightly controlled systems. In this situation the current Keygen in non-IE browsers is often the only error free method to generate and use Client certificates
Cons & Deficiencies
Certificates are not easily portable between systems (to some, this is a "pro")
The private key is not stored in a standard location
The UI is confusing and difficult to understand
Requires the user to select the appropriate key length from a list. Most users are not equipped to make this decision.
Poor user experience when the user is prompted to download the certificate. A better approach would have the key submission and certificate response integrated into the same control. (possible solution also this on S.O. )
<keygen>does not provide a mechanism for managing certificate expiry
No standard key length or hash implemented across browsers
Algorithm support is missing (RSA, DSA, ECC, etc)
Keysize selection should come from the form, not user selectable.
The signature is based on MD5 (which can be mitigated by a time based challenge)
Non-Exportable keygen flag is missing
Hardware protected keygen flag is missing
Password protection required is missing
The certificate is limited to RSA based applications
The HTML form could be modified locally and key generation security reduced accordingly
The format used by is not standard and only provides a subset of already established protocols like PKCS10 , CMC , and CRMF . This prevents from supporting non-RSA based certificates, extensions for additional client information, and key escrow
Not supported in IE due to better support with
CertEnrolland the issues described here