2

With JavaScript in the browser, I need to digitally sign some data. I'm looking at the new Crypto.Subtle api, specifically the sign() and importKey() methods. I want, very reasonably I feel, to install a certificate on a mobile device, outside of my web app, then, in the web app, to sign some stuff with the installed certificate without directly manipulating or seeing the private key. However I can't see if or how the Crypto API interfaces with installed certificates.

Am I missing something obvious? If this is not possible, are there browser plugins that can help me? I see in 2009 someone did this with an MS ActiveX object, but there must be a better way six years later?

0

It's not possible, not without significant effort by browser authors (or browser plugin authors) to make it possible. Remember, the point of signing something is to verify that its authenticity - that is, that the signer meant to sign that thing, with that key, and they are the only one with the key - so having a way for web page content (which is inherently untrustworthy code, from a browser's point of view) to access a user's signing keys would be a major security risk! Even just enumerating installed keys would allow for user fingerprinting and tracking.

Now, a browser (or plugin) could attempt to do this securely, by offering a JS API that basically prompts the user "A script on site is attempting to access your certificate store. [Allow] [Deny (default)]" and then a similar prompt (if the first is approved) for access to your private key (and password for it if needed). I would be very cautious about such a feature, though.

  • I'm not the only one asking, and things seem to be moving in this direction, but I see at the moment it's not really possible in the browser. – bbsimonbb Sep 17 '15 at 10:16
  • Oh, I can definitely see the usefulness. For trusted sites, it would be extremely handy, and people are already working on things of this nature. It's just, the whole area is risky from a security and privacy standpoint, so any design safe enough to be made standard will take a while to flesh out. – CBHacking Sep 17 '15 at 19:08
  • Absolutely. And if we can't do it in the browser, we're pretty much obliged to go native, and native applications will not necessarily do a better job of safeguarding the user's interests. – bbsimonbb Sep 18 '15 at 8:43
0

It's not possible in a plain browser. But if you try to run your web app, you will certainly use some kind of wrapper lib to convert it to android application (or ios, etc). This way you can do what your wrapper can do on the mobile device. If you write your own wrapper, and you have the proper rights, you can do anything what other mobile apps can do.

Most popular wrapper like phoneGap gives you api for file access, this way you can access your key (btw, signing is done by privkey not by certificates).

However I agree with CBHacking, it wouldnt be a very wise idea to access your precious keys from javascript. Maybe a better approach to create some API call which signs that message for you. Scripts will never touch the keys then.

0

Most of the web applications require Digital Signing documents, files, eReturns (XML or JSON) etc, from the user's browser using the user's local machine keystore, USB token or smartcard. Older methods being Java applets, Active X, etc. which are phased out or are being phased out from the new modern browser offerings.

Recently much is being talked about WebCrypto API but as of now, WebCrypto API does not provide access to Windows' or any other keystores or a local crypto USB/smartcard device.

Thus, it's good practice, to use JavaScript through a browser extension to access some application running on the local system to access the local KeyStore/CertificateStore and produce the signature and send it back (PKCS7 or CMS container in case of PDF signing) to the server where the signature may be injected back to the PDF from which the hash was created for signing, and was sent to the browser or to a signing API server.

One such free extension is provided by my company. Please refer Signer.Digital Browser Extension which points to a number of Stack Overflow answers providing JavaScript code to achieve different signing functions.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.