Product
Introducing License Enforcement in Socket
Ensure open-source compliance with Socket’s License Enforcement Beta. Set up your License Policy and secure your software!
tresorit-node-webcrypto-ossl
Advanced tools
A WebCrypto Polyfill for Node in TypeScript built on OpenSSL
We wanted to be able to write Javascript that used crypto on both the client and the server but we did not want to rely on Javascript implementations of crypto. The only native cryptography available in browser is Web Crypto, this resulted in us creating a node-webcrypto-ossl
a native polyfill for WebCrypto based on OpenSSL.
At this time this solution should be considered suitable for research and experimentation, further code and security review is needed before utilization in a production application.
npm install node-webcrypto-ossl;
git clone https://github.com/PeculiarVentures/node-webcrypto-ossl
cd node-webcrypto-ossl
npm install
mocha
Algorithm name | generateKey | digest | export/import | sign/verify | encrypt/decrypt | wrapKey/unwrapKey | derive |
---|---|---|---|---|---|---|---|
SHA-1 | X | ||||||
SHA-256 | X | ||||||
SHA-384 | X | ||||||
SHA-512 | X | ||||||
RSASSA-PKCS1-v1_5 | X | X | X | ||||
RSA-PSS | X | X | X | ||||
RSA-OAEP | X | X | X | X | |||
AES-CBC | X | X | X | X | |||
AES-CTR | X | X | X | X | |||
AES-ECB 2 | X | X | X | X | |||
AES-GCM | X | X | X | X | |||
AES-KW | X | X | X | ||||
ECDSA | X | X | X | ||||
ECDH | X | X | X | ||||
HMAC | X | X | X | ||||
PBKDF2 | X | X |
2 ECB support is not defined by the WebCrypto specifications. Use of ECB in a safe way is hard, it was added for the purpose of enabling interoperability with an existing system. We recommend against its use unless needed for interoperability.
var WebCrypto = require("node-webcrypto-ossl");
var webcrypto = new WebCrypto();
To use KeyStorage you should init WebCrypto with directory
option. If directory
option is missing then keyStorage
is null
var WebCrypto = require("node-webcrypto-ossl");
var webcrypto = new WebCrypto({
directory: "key_storage"
})
KeyStorage implements interface of W3 Storage
var keyStorage = webcrypto.keyStorage;
// generating RSA key
webcrypto.subtle.generateKey({
name: "RSASSA-PKCS1-v1_5",
modulusLength: 1024,
publicExponent: new Uint8Array([1, 0, 1]),
hash: {
name: "SHA-1"
}
},
false,
["sign", "verify"]
)
.then(function(keyPairs){
/**
* saving private RSA key to KeyStorage
* creates file ./key_storage/prvRSA-1024.json
*/
keyStorage.setItem("prvRSA-1024", keyPairs.privateKey);
})
To get key from KeyStorage
var rsaKey = webcrypto.getItem("prvRSA-1024");
The threat model is defined in terms of what each possible attacker can achieve.
TODO: ADD ASSUMPTIONS
TODO: ADD THREATS FROM NODE-WEBCRYPTO-OSSL DEFECT
TODO: ADD THREATS FROM WEAK CRYPTOGRAPHY
TODO: ADD THREATS FOR IMPROPER USE OF CRYPTOGRAPHY
Please report bugs either as pull requests or as issues in the issue tracker. node-webcrypto-ossl has a full disclosure vulnerability policy. Please do NOT attempt to report any security vulnerability in this code privately to anybody.
FAQs
A WebCrypto Polyfill for Node in TypeScript built on OpenSSL
The npm package tresorit-node-webcrypto-ossl receives a total of 2 weekly downloads. As such, tresorit-node-webcrypto-ossl popularity was classified as not popular.
We found that tresorit-node-webcrypto-ossl demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Product
Ensure open-source compliance with Socket’s License Enforcement Beta. Set up your License Policy and secure your software!
Product
We're launching a new set of license analysis and compliance features for analyzing, managing, and complying with licenses across a range of supported languages and ecosystems.
Product
We're excited to introduce Socket Optimize, a powerful CLI command to secure open source dependencies with tested, optimized package overrides.