Javascript and Cryptography

There are numerous software cryptographic libraries written in various programming languages and we would naturely expect to have at least some of them to be available in Javascript to be able to encrypt and sign in a pure cross browser code.
Here is a partial list of such libraries with a varying functionality:
Stanford Javascript Crypto Library -: http://crypto.stanford.edu/sjcl/

One way I prefer to use these libraries would be by encrypting user data with a key derived from a password right before it is being sent to the server for storage.
This password can be stored in the HTML5 browser store or acquired from the user on every new session ;
The data is then decrypted again each time the user would explicitly ask to retrieve it from the server.

It is important to use it with an SSL protected websites to prevent imposters from sending harmful Javascript code that would potentialy compromise the plain text by sending it somewhere in a background process or even getting grip of the key in the HTML5 secure store.

The main advantage of this all is that the process here does not require an ActiveX or Java Applet to perform the encryption and key management.




Post a Comment

Previous Post Next Post