Microsoft eggheads publish JavaScript crypto code for devs Microsoft Research has published an under-development JavaScript crypto library, for exposure to developers and researchers interested in cloud and browser security. Designed to work with HTML5-compliant cloud services, the Microsoft Research JavaScript Cryptography Library uses the W3C WebCrypto API to expose crypto functions …
Which you can look at because you're downloading it and verify for yourself.
The back-end systems are a different matter, of course, but this bit literally cannot be other than legit without everyone knowing about it inside about a day.
--off topic
You know, I don't really like MS very much. Not much at all, in fact. The only thing they do for me is (indirectly) keep me in work. If they went bust I'd still have work, albeit using different tools but for now they keep me in work. No, I do not work for them. I really am not all that keen on any giant multinational money machine, to be honest. None of them are my friend and none of them want to be.
I am aware that here on the Register, it can seem that I am pro-Microsoft. I am not. It only looks that way because the commentards here are so anti-Microsoft that they are, in large numbers, utterly irrational on the subject. It's an odd situation. To autoGodwinize, it's a bit like accusing Oskar Schindler of being an Elder of Zion instead of just anti-murder.
Could be worse. Have you ever tried working in a language that uses integers as bools because it doesn't have real bools?
That's one of many insane problems with it (it also lacks real arrays for instance). Rumor amongst the community is that the guy who created the language did so in one all-nighter while drunk. It's not a hard rumor to believe. I suspect it would die a very quick death were there any other alternative in the environment where it's used.
then don't write in it. Those of us who do use it can actually get quite attached to it's almost psychopathic casting and crazy function scope. Going back to a strongly typed language with real arrays is a step backwards in a lot of ways. You mean I can't just push and pop things off that array? I have to check that string for being nothing and for being empty? Tedious. Or just different, ymmv.
Okay. So I as I understand it WebCrypto provides an API to "crypto primitives" via the browser. Playing the role of Mallory, what's to stop me from then bypassing this Javascript tier entirely and returning whatever I feel like to the caller?
Point being - the crypto itself can be harder than a coffin nail but that counts for nothing if the environment the code is running in can't be trusted? Or is the idea that I'd be running this through Node.Js or something?
Playing the role of Mallory, what's to stop me from then bypassing this Javascript tier entirely and returning whatever I feel like to the caller?
That's not a description of an attack scenario; it's a vague handwave in the direction of one. You might as well ask "what's to stop me from preventing the user from encrypting sensitive data?". We don't know, because you haven't described the application.
The point of the WebCrypto API is to provide a standard way for a user agent ("browser") to encrypt, and apply other cryptographic primitives (digest, signature, pad, HMAC, etc) to select pieces of data. Then it might send the results of such an operation to a server, or it might not; and it might apply those operations to data received from a server.
Is there scope for an attacker to interfere? Of course there is, as with any security system. But positing a magical attacker who can simply "bypass[] this Javascript tier" isn't a useful critique.
Michael,
It seems I'm not making myself clear as you have over generalized what I'm saying. I'm not providing a critique - I'm asking for genuine opinions on why I would want to do my cryptography in an untrusted environment.
The last reading I did on the subject was this document which makes some very valid points and explains the issue better than I did above:
http://matasano.com/articles/javascript-cryptography/
So - I'm asking out of genuine interest - does WebCrypto advance us further from where we were when this document was written?
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
