15 ms·
If you're not shipping your cryptography in a browser extension, npm module, etc. then you might as well not implement the cryptography features. http://matasa
by sarciszewski 12y ago
If you're not shipping your cryptography in a browser extension, npm module, etc. then you might as well not implement the cryptography features.
http://matasano.com/articles/javascript-cryptography/ http://matasano.com/articles/javascript-cryptography/
- zokier 12y agoSee also: Google End-To-End https://github.com/google/end-to-end https://github.com/google/end-to-end
- sarciszewski 12y ago"End-To-End is a Chrome extension..." Your argument is invalid.
- lewisl9029 12y agoThe WebCrypto API is meant to solve this but many aspects of it are not quite ready for production yet. I'd personally love to see JS crypto libraries like CryptoJS, SJCL and Forge start implementing polyfills for WebCrypto. Even just using the getRandomValues method (which seems to be fairly stable across all modern browsers) for their PRNG implementations would result in a much more theoretically sound crypto library. http://www.w3.org/TR/WebCryptoAPI/ http://www.w3.org/TR/WebCryptoAPI/ https://github.com/digitalbazaar/forge https://github.com/digitalbazaar/forge https://github.com/bitwiseshiftleft/sjcl https://github.com/bitwiseshiftleft/sjcl https://code.google.com/p/crypto-js/ https://code.google.com/p/crypto-js/
- tracker1 12y agoI'd like to see more async implementations of crypto for JS, breaking work up with setTimeout/setImmediate so that they don't kill the browser... Lately, I'm more inclinded to first reach for the browserify polyfills, and use the node crypto api.