3 ms·

How does User B obtain the password to decrypt the file? How does the key distribution part work?

• colept 10y ago
  It's a plaintext password - not nearly as secure as PGP or the like.
  • StavrosK 10y ago
    There's no "non-plaintext password", encryption keys are encryption keys. I don't know if SJCL includes asymmetric crypto, but there's nothing wrong with AES.
    • tptacek 10y ago
      SJCL includes public-key crypto, and its defaults include an iterated KDF for password-based encryption, and CCM with random IVs. It's one of the better crypto interfaces (though, again, it's hamstrung when it's run inside a browser).
      • StavrosK 10y ago
        Ah, thanks. Last I used it, I only needed the symmetric part, so I couldn't remember whether it had an asymmetric part as well. It is a very good library indeed, and was (at least partly) written by Dan Boneh, whom I regard highly.
        • tptacek 10y ago
          "bitwiseleftshift" is Mike Hamburg. :)
          • StavrosK 10y ago
            I was just wondering that! Half the contributors on the Github repo have the default avatars and barely any info on their profiles, so I couldn't figure out who was who.