3 ms·

I remember a discussion on here before of why using JS crypto (different implementation) was a bad idea (in short, a mitm could give you a broken jscrypto funct

I remember a discussion on here before of why using JS crypto (different implementation) was a bad idea (in short, a mitm could give you a broken jscrypto functions which don't really encrypt). So no, you wouldn't want to use this in place of TLS, but the authors give some decent reasons why you actually might want to do this: One major reason is the need to encrypt data before uploading it to a server; this is useful where the server needs to store data but doesn't wish to see it in the clear. It can also be used in desktop applications written in Javascript - for example, Firefox extensions. Can anyone think of other good reasons?

cortesi 17y ago
You can't generalise MITM and injection attacks to "Javascript crypto is bad". There's an idea floating around called "host proof hosting" - or in the Clipperz parlance, "zero-knowledge applications" - that I think could be potentially very important in future, and that relies entirely on Javascript crypto. The only problem is that I haven't seen it done right yet - every application I've looked at that claims to implement this paradigm has some enormous, glaring shortcoming. I'm working on an epic tldr; blog post and an associated project release related to this - keep an eye out for it next week.
- colonelxc 17y ago
  You're right about that, I certainly over generalized the issue. I should have just stuck with "javascript crypto shouldn't be used in place of TLS." The host proof hosting stuff is pretty interesting. Some people implement something similar when using dropbox, by encrypting the files before they are synced. A disadvantage of this method (other than being cumbersome), is that you lose the bandwidth savings of Dropbox's deltas.
defen 17y ago
I believe that another problem with non-native crypto implementations is that they are more vulnerable to timing attacks, because you have less control over what the computer is actually doing. Note: I am not a cryptographer, and I don't even play one on TV.

cortesi 17y ago

You can't generalise MITM and injection attacks to "Javascript crypto is bad". There's an idea floating around called "host proof hosting" - or in the Clipperz parlance, "zero-knowledge applications" - that I think could be potentially very important in future, and that relies entirely on Javascript crypto. The only problem is that I haven't seen it done right yet - every application I've looked at that claims to implement this paradigm has some enormous, glaring shortcoming. I'm working on an epic tldr; blog post and an associated project release related to this - keep an eye out for it next week.

colonelxc 17y ago
You're right about that, I certainly over generalized the issue. I should have just stuck with "javascript crypto shouldn't be used in place of TLS." The host proof hosting stuff is pretty interesting. Some people implement something similar when using dropbox, by encrypting the files before they are synced. A disadvantage of this method (other than being cumbersome), is that you lose the bandwidth savings of Dropbox's deltas.

defen 17y ago

I believe that another problem with non-native crypto implementations is that they are more vulnerable to timing attacks, because you have less control over what the computer is actually doing. Note: I am not a cryptographer, and I don't even play one on TV.