Understanding JavaScript Cryptography using Stanford Javascript Crypto Library

Question

I would need to encrypt the some content before saving it on local storage in html5 and JS, at the moment I use Stanford Javascript Crypto Library.

At the moment I use a code like this.

usernameEnc = sjcl.encrypt("password", username);
passwordEnc = sjcl.encrypt("password", password);
localStorage.username = usernameEnc;
localStorage.password = passwordEnc;

I am able to encrypt correctly. As I am building a HTML5 application with JS and the JS code is download in the client, how can I protect the PASSWORD for avoiding easily decrypt the script?

Maybe I miss the point I am little puzzled.

If you want to keep the password a secret, you either have to ask the user to provide their own, or do the encryption and decryption on your server instead of in the browser. — robertklep
– robertklep, Commented Mar 5, 2013 at 9:24

Henrik Aasted Sørensen · Accepted Answer · 2013-03-05 09:32:07Z

4

Unfortunately, there is no way for you to protect your key. It's JavaScript and it should somehow be downloaded to be executed in the browser. You can obfuscate the key to make it a little hard but someone with average knowledge would be able to break it.

What I would suggest doing is that you can encrypt the contents using the user's password. So every time the user should enter the password to decrypt the contents.

Don't use the users password just as it is. Use a key derivation function such as PBKDF2. There's a JavaScript implementation for PBKDF2 in the crypto-js library.

Anyway something that you ought to know is that if your application can read it in the client side, someone determined can read it too no matter how hard you try to protect it.

edited Mar 5, 2013 at 9:32

Henrik Aasted Sørensen

7,18611 gold badges55 silver badges66 bronze badges

answered Mar 5, 2013 at 9:23

Jude Cooray

19.9k21 gold badges85 silver badges128 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

Maarten Bodewes Over a year ago

SSL could be used to protect the code running in the browser, so that would include the password.

Jude Cooray Over a year ago

@owlstead: Yes, it will protect while it's transferred between the server and the browser.

Jamie Clayton Over a year ago

We will have to wait for w3.org/2012/webcrypto the W3C specification and how it deals with the underlying operating systems KeyStore to be resolved.

Collectives™ on Stack Overflow

Understanding JavaScript Cryptography using Stanford Javascript Crypto Library

1 Answer 1

3 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

3 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related