Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

First off, this is in addition to using SSL! I am building a web application that receives encrypted data from a server. The data is to be decrypted client-side. I've read enough posts here to see that security implemented with JavaScript is hardly security at all, so I'm looking for an alternative to JavaScript based decryption.

I came across Java Server Faces, and I feel as though it may be a better solution than JavaScript. I wrote a small app and couldn't find the "password" or key saved anywhere in the DOM (using firebug) which looks like a win to me.

Sorry if this is a silly question, but I was really struggling to find information about the security JSF decryption elsewhere. Thanks in advance!

share|improve this question
1  
What type of data are you sending? Why do you want additional encryption on top of SSL? –  Terry Chia Jul 23 '13 at 12:18
    
Data about production in factories, my boss wants the additional encryption :) –  PunDefeated Jul 23 '13 at 12:20
    
Okay, after you clarified your situation in the comments on my answer, I see that I was wrong. I've deleted my answer. –  Adnan Jul 23 '13 at 13:15
    
@Adnan the discussion was very helpful for me, so thanks regardless! –  PunDefeated Jul 23 '13 at 13:29
add comment

1 Answer

up vote 2 down vote accepted

JSF works server side(it renders html/js).... so anything you decrypt in JSF is send out as html/js to the client's web browser (no additional security there).

If you want client side decryption use applets, or thick clients to do the work, and use TLS as transport layer. Any other js decryption thing will not work, and it's a waste of time and money. Of course applets and thick clients are not totally secure either but they can be more of a challenge than js.

share|improve this answer
    
Looks like an Applet might be the way to go, thanks! –  PunDefeated Jul 23 '13 at 12:40
1  
By using an applet, you are increasing the attack surface, hence adding the extra layer of encryption is arguably decreasing the overall security. –  symcbean Jul 23 '13 at 14:39
    
@symcbean - I agree. If you don't trust SSL to protect the data then you can't trust it to pass the decryption applet (which contains your decryption key). In security more doesn't always equal better. –  u2702 Jul 23 '13 at 16:24
    
Applet does not have to contain decryption key, it can access HSM via some secure api... That's how mainly digital signing on web based systems work, accessing smartcard reader via some dll's. –  fatfredyy Jul 24 '13 at 6:01
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.