Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need to generate a RSA key pair with Javascript. This key pair will be used for encrypting a one time blob of data (20-100kb), then discarded. This data can be reduced to a couple of hundred kb or less if I only encrypt data that needs to be secure and not other resources such as image files for the application.

Should I write my own implementation or are there any libraries that I can trust to be both stable and secure?

share|improve this question
Definitely do not write your own implementation. Just don't. Better to redesign your whole application, than to write your own implementation... – AviD Jul 26 '11 at 5:40
up vote 3 down vote accepted

You could take a look at the GWT Crypto package. Its a port of some of the BouncyCastle stuff into GWT, so you should be able to take the compiled output and massage it a bit so you can call it from your current Javascript. It currently supports RSA keypair generation and encryption/decryption, as well as AES and DES. I think that's about it though.

I personally have not used this library, but since it was ported from BC it should be safer than writing your own implementation. That said, I dont know where they sourced their SecureRandom implementation from. You may need to look to see if its actually a cryptographically secure implementation or not. I took a quick look and they are just doing something with SHA and the seed bytes, but I dont know if that qualifies or not.

One last thing. I have found using RSA to encrypt large amounts of data to be quite slow. Perhaps you may want to use a hybrid solution of some sort where you encrypt an AES256 key using the RSA keypair and then use AES to encrypt the data? Could be faster...

share|improve this answer
I can change my code to just encrypt the parts of the package that differ between clients (ie. the secure stuff). How do I know BouncyCastle is secure? – Casebash Jul 26 '11 at 5:00
Aside from paying someone you trust to inspect it? I suppose you dont. However, BouncyCastle is the crypto provider in Google's Android. Perhaps if its good enough for them its good enough for you? That's really a tough question and I dont know what right answer is. As far as I know it doesnt have any government certifications or anything... – senecaso Jul 26 '11 at 5:13
It appears that the Google Web Toolkit is not really designed to support this use case:!topic/google-web-toolkit/2a6HnMJJ0ss. I could use GWT Exporter, but I think its best just to find a javascript library – Casebash Jul 27 '11 at 5:38
Ya, like I said, you would have to "massage" the output. Still, its almost certainly safer than implementing your own! :) You could try jscryptolib, but I dont know how trusted it is, not to mention there hasnt been any activity on the project for ~2yrs. The other implementations that come up with a google search seem to be personal/student projects, so I dont know how much faith should be put into them being correct. – senecaso Jul 27 '11 at 6:26

Check the jsencrypt project. If you use nodejs I recommend node-rsa module.

share|improve this answer

You should really avoid doing cryptography in javascript. The short reason is because you cannot trust a javascript program. The long answer can be found here:

Even if you web application is written to be secure against XSS, CSRF, etc. attacks, javascript is run in a virtual machine with no proof of security. The javascript JIT compiler might introduce shortcuts in the code and thus render it be vulnerable to timing attacks.

If you need to encrypt the transmission of data, you should use TLS. If you need to encrypt stored data, you should use a good symmetric algorithm (such as AES 256 in GCM mode).

If you want a better answer, I suggest you to tell us why you think you need RSA. What problem you want to solve with it? Maybe RSA (in javascript or not) is not the best solution (or not even a good one).

share|improve this answer
Can you at least summarize why you "can't trust a Javascript program"? – schroeder Sep 10 '14 at 14:38
Somehow, I don't think he'll answer your question, 3+ years after he sought help. – Chris Murray Sep 10 '14 at 15:27
@schoreder I added an example. There is so many ways to attack a javascript code, I'm not sure it can be summarized. – Anonymous Coward Sep 10 '14 at 15:28
@ChrisMurray I saw it afterwards. – Anonymous Coward Sep 10 '14 at 15:32

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.