Socket
Socket
Sign inDemoInstall

@peculiar/webcrypto

Package Overview
Dependencies
7
Maintainers
6
Versions
53
Alerts
File Explorer

Advanced tools

Install Socket

Detect and block malicious and high-risk dependencies

Install

    @peculiar/webcrypto

A WebCrypto Polyfill for NodeJS


Version published
Maintainers
6
Install size
1.02 MB
Created

Package description

What is @peculiar/webcrypto?

The @peculiar/webcrypto package is an implementation of the Web Cryptography API for Node.js. It provides cryptographic operations in web applications, including hashing, signature generation and verification, encryption and decryption, and key generation and management. This package is particularly useful for server-side applications that require cryptographic operations consistent with those available in the browser.

What are @peculiar/webcrypto's main functionalities?

Generating cryptographic keys

This code sample demonstrates how to generate a cryptographic key pair using RSA-PSS algorithm. The generated keys can be used for signing and verification purposes.

const { Crypto } = require('@peculiar/webcrypto');
const crypto = new Crypto();

async function generateKey() {
  const key = await crypto.subtle.generateKey(
    {
      name: 'RSA-PSS',
      modulusLength: 2048,
      publicExponent: new Uint8Array([1, 0, 1]),
      hash: 'SHA-256',
    },
    true,
    ['sign', 'verify']
  );
  return key;
}

Encrypting and decrypting data

This code sample shows how to encrypt data using a public key and decrypt it using a private key with the RSA-OAEP algorithm. It's useful for secure data transmission.

const { Crypto } = require('@peculiar/webcrypto');
const crypto = new Crypto();

async function encryptData(publicKey, data) {
  const encryptedData = await crypto.subtle.encrypt(
    {
      name: 'RSA-OAEP'
    },
    publicKey,
    data
  );
  return encryptedData;
}

async function decryptData(privateKey, encryptedData) {
  const decryptedData = await crypto.subtle.decrypt(
    {
      name: 'RSA-OAEP'
    },
    privateKey,
    encryptedData
  );
  return decryptedData;
}

Signing and verifying data

This example demonstrates signing data with a private key and verifying the signature with the corresponding public key using the RSA-PSS algorithm. It's essential for ensuring data integrity and authenticity.

const { Crypto } = require('@peculiar/webcrypto');
const crypto = new Crypto();

async function signData(privateKey, data) {
  const signature = await crypto.subtle.sign(
    {
      name: 'RSA-PSS',
      saltLength: 32,
    },
    privateKey,
    data
  );
  return signature;
}

async function verifySignature(publicKey, signature, data) {
  const isVerified = await crypto.subtle.verify(
    {
      name: 'RSA-PSS',
      saltLength: 32,
    },
    publicKey,
    signature,
    data
  );
  return isVerified;
}

Other packages similar to @peculiar/webcrypto

Changelog

Source

1.5.0 (2024-05-28)

Features

  • Add support for Ed25519 and X25519 algorithms (a0cf289)

Readme

Source

@peculiar/webcrypto

License test Coverage Status npm version

We wanted to be able to write Javascript that used crypto on both the client and the server but we did not want to rely on Javascript implementations of crypto. The only native cryptography available in browser is Web Crypto, this resulted in us creating a @peculiar/webcrypto.

Table Of Contents

WARNING

At this time this solution should be considered suitable for research and experimentation, further code and security review is needed before utilization in a production application.

Module is based on NodeJS v10 Crypto API. It would work only with Node v10 and higher.

Installing

npm install @peculiar/webcrypto

Supported algorithms

Algorithm namegenerateKeydigestexport/importsign/verifyencrypt/decryptwrapKey/unwrapKeyderive
SHA-1X
SHA-256X
SHA-384X
SHA-512X
HMACXXX
RSASSA-PKCS1-v1_5XXX
RSAES-PKCS1-v1_52XXXX
RSA-PSSXXX
RSA-OAEPXXXX
AES-CMACXXX
AES-CBCXXXX
AES-CTRXXXX
AES-ECBXXXX
AES-GCMXXXX
AES-KWXXX
ECDSA1XXX
ECDH1XXX
EdDSA2,3XXX
ECDH-ES2,4XXX
HKDFXX
PBKDF2XX
DES-CBC2XXXX
DES-EDE3-CBC2XXXX
shake1282X
shake2562X

1 Mechanism supports extended list of named curves P-256, P-384, P-521, K-256, brainpoolP160r1, brainpoolP160t1, brainpoolP192r1, brainpoolP192t1, brainpoolP224r1, brainpoolP224t1, brainpoolP256r1, brainpoolP256t1, brainpoolP320r1, brainpoolP320t1, brainpoolP384r1, brainpoolP384t1, brainpoolP512r1, and brainpoolP512t1

2 Mechanism is not defined by the WebCrypto specifications. Use of mechanism in a safe way is hard, it was added for the purpose of enabling interoperability with an existing system. We recommend against its use unless needed for interoperability.

3 Mechanism supports extended list of named curves Ed25519, and Ed448

4 Mechanism supports extended list of named curves X25519, and X448

Using

const { Crypto } = require("@peculiar/webcrypto");

const crypto = new Crypto();

Examples

See WebCrypto Docs for examples

Bug Reporting

Please report bugs either as pull requests or as issues in the issue tracker. @peculiar/webcrypto has a full disclosure vulnerability policy. Please do NOT attempt to report any security vulnerability in this code privately to anybody.

Keywords

FAQs

Last updated on 28 May 2024

Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Install

Related posts

SocketSocket SOC 2 Logo

Product

  • Package Alerts
  • Integrations
  • Docs
  • Pricing
  • FAQ
  • Roadmap

Stay in touch

Get open source security insights delivered straight into your inbox.


  • Terms
  • Privacy
  • Security

Made with ⚡️ by Socket Inc