Is a JavaScript implementation of AES any less secure than other language implementations?

Question

There are a few JavaScript AES implementations available such as Gibberish-aes

So assuming the AES algorithm has been implemented correctly in this library then it should be as secure as any other language implementation ? And if not why not ?

Answer 1

AES is a specification that can be implemented in any programming language.

If you are thinking about doing encryption in JavaScript to avoid using https, this will not be secure: Transmitting the HTML file or any included JavaScript via an http connection allows an attacker to modify it. So in addition to doing the encryption it can send the information unencrypted to another server.

Answer 2

"Implementing the AES" means producing the precise ciphertext that the standard mandates for a given plaintext and key; we are talking about exact values, down to the last bit, so the general answer to your question is: yes, it is "as secure" as if it was implemented with any other language.

The paragraph above is about "secure" when applied to the protocol, i.e. in the view of an attacker who observes what travels on the wires. There is another meaning of "secure", when applied specifically to the implementations: it is the ability of the implementation of not leaking key information to an attacker who has physical (or utterly logical) access to the hardware. A Javascript implementation runs in the Web browser and cannot really hide anything from whoever has access to the Web browser and, in particular, its "debug script" features. But a C-based implementation cannot protect itself either against such a local attacker; so this notion is probably not the one you are using.