5 ms·
It's a plaintext password - not nearly as secure as PGP or the like.
by colept 10y ago
It's a plaintext password - not nearly as secure as PGP or the like.
- StavrosK 10y agoThere's no "non-plaintext password", encryption keys are encryption keys. I don't know if SJCL includes asymmetric crypto, but there's nothing wrong with AES.
- tptacek 10y agoSJCL includes public-key crypto, and its defaults include an iterated KDF for password-based encryption, and CCM with random IVs. It's one of the better crypto interfaces (though, again, it's hamstrung when it's run inside a browser).
- StavrosK 10y agoAh, thanks. Last I used it, I only needed the symmetric part, so I couldn't remember whether it had an asymmetric part as well. It is a very good library indeed, and was (at least partly) written by Dan Boneh, whom I regard highly.