Encryption and decryption using Javascript

How to encrypt on the browser-the challenge we face when creating an Opal website using Javascript encryption and decryption is to find a reliable method to encrypt and decrypt on the browser.

This article describes the challenges faced by browser-side encryption and points out a solution provided by recent technological advances.

Three options for encryption in Web Applications

Only JavaScript is supported by all browsers. Similar to Opal, Web applications are written in JavaScript to operate on any modern browser. If these applications require encryption functions, JavaScript must be able to access them.

Currently, to expose the encryption function to the browser's JavaScript, there are only three options:

1. Use plug-in encryption

Plug-ins are compiled code that runs in a browser and can be called by JavaScript.

For example, an encrypted library exists in Java and Flash. This method is usually highly performing, but users need to install browser plug-ins. This is what people do not want or cannot do (if they are using a public computer ).

Another option is to use the Native Client program of Chrome browser, which allows running machine code compiled by C or C ++. Similarly, this method has high performance, but the NaCl client can only be used in Chrome browsers.

Even if these plug-ins and NaCl client programs have a speed advantage, this approach is not very portable because they require users to use special plug-ins or use specific browsers.

2. Use Web encryption API

The upcoming Web encryption API will provide JavaScript with a basic native encryption interface, allowing Web applications to encrypt and decrypt data more quickly. However, this interface is still in the draft phase, and it takes a long time for mainstream browsers to adopt this technology. Currently, only crypto. getRandomValues () functions can be used in most browsers.

Before the extensive application of Web encryption APIs, this is not a practical browser-side encryption solution.

3. Use JavaScript encryption directly

The advantage of this solution lies in its high portability. All browsers can execute JavaScript, which means all browsers can call the encrypted library written in JavaScript.

Encryption in JavaScript has two major defects: security and speed. We will take turns to talk about these two defects.

JavaScript encryption can become secure

Some articles claim that "JavaScript encryption is harmful" and list a lot of evidence to support this discussion.

Some of the points in this article are no longer accurate. For example, the Math. random () function is not a good source of random numbers, so it is impossible to obtain enough random numbers for encryption. The Math. random () function is indeed not a good source of random numbers. In modern browsers, the crypto. getRandomValues () function has been provided to obtain a sufficient number of random numbers.

There are many cases in this post that prove JavaScript encryption is a bad idea, but it also makes sense.

This answer refuted many of the points in the first post, and also pointed out two effective use cases of JavaScript encryption: end-to-end information encryption (that is, the application that protects host access) and secure remote password authentication. These are exactly the application scenarios of Opal encryption, so it is natural to use JavaScript encryption.

JavaScript encryption can be fast

Until recently, JavaScript was slow in the complex computation used for secure encryption. This directly causes many applications to rely on the encryption function provided by the plug-in. This method is portable and annoying to users.

Fortunately, the performance of JavaScript has been greatly improved in recent years, so it is feasible to use JavaScript For encryption operations completely. Currently, many JavaScript encryption libraries are available (link 1, link 2, link 3, Link 4, link 5, link 6, link 7, link 8, and link 9 ).

So it becomes the question of which database to choose.

NaCl, a trusted C-language encryption Library

NaCl (read as "salt") is a C-language library that provides symmetric key encryption and decryption and Public Key signature authentication. It is well known and trusted in the encryption community by cryptographic people. One problem is that NaCl is written in C rather than JavaScript.

Js-NaCl: Compile NaCl into JavaScript

Fortunately, we can compile NaCl into LLVM bytecode and then use emscripten to compile these bytecode into JavaScript. In addition, the LLVM compiler can perform many optimizations during compilation, so the JavaScript code is also optimized. Therefore, we can compile the NaCl library into JavaScript to prepare for running in the browser!

The js-nacl project is compiled into a JavaScript NaCl encryption library.

Asm. js is fast!

Better yet, the Code Compiled by emscripten is a subset of JavaScript, also known as asm. js. You can use asm. js as an assembly language similar to JavaScript. When the browser encounters an asm. js code block, it will compile it into an efficient machine code, and the running speed is close to that of the native code.

Currently, only Firefox supports the optimization of asm. js. This allows js-nacl to encrypt and decrypt in Firefox very quickly, depending on the specific operation, it is 2 to 8 times faster than Chrome. However, even Chrome and js-nacl were faster than all the other encryption libraries we tested.

The trusted encryption Library such as NaCl and the rapid execution of modern browsers make JavaScript-nacl libraries applicable to Web applications such as Opal.

For the same reason, Opal uses the scrypt library of asm. js compiled by emscripten to extend the key (which is enabled in this article ). You can see the comparison of js-nacl and js-scrypt performance provided by the Project maintainer. We also tested jsperf for js-nacl to understand the performance differences between different browser versions. You can also try it at will.