First off, this is in addition to using SSL! I am building a web application that receives encrypted data from a server. The data is to be decrypted client-side. I've read enough posts here to see that security implemented with JavaScript is hardly security at all, so I'm looking for an alternative to JavaScript based decryption.

I came across Java Server Faces, and I feel as though it may be a better solution than JavaScript. I wrote a small app and couldn't find the "password" or key saved anywhere in the DOM (using firebug) which looks like a win to me.

Sorry if this is a silly question, but I was really struggling to find information about the security JSF decryption elsewhere. Thanks in advance!

  • 1
    What type of data are you sending? Why do you want additional encryption on top of SSL? – user10211 Jul 23 '13 at 12:18
  • Data about production in factories, my boss wants the additional encryption :) – PunDefeated Jul 23 '13 at 12:20
  • Okay, after you clarified your situation in the comments on my answer, I see that I was wrong. I've deleted my answer. – Adi Jul 23 '13 at 13:15
  • @Adnan the discussion was very helpful for me, so thanks regardless! – PunDefeated Jul 23 '13 at 13:29

JSF works server side(it renders html/js).... so anything you decrypt in JSF is send out as html/js to the client's web browser (no additional security there).

If you want client side decryption use applets, or thick clients to do the work, and use TLS as transport layer. Any other js decryption thing will not work, and it's a waste of time and money. Of course applets and thick clients are not totally secure either but they can be more of a challenge than js.

  • Looks like an Applet might be the way to go, thanks! – PunDefeated Jul 23 '13 at 12:40
  • 1
    By using an applet, you are increasing the attack surface, hence adding the extra layer of encryption is arguably decreasing the overall security. – symcbean Jul 23 '13 at 14:39
  • @symcbean - I agree. If you don't trust SSL to protect the data then you can't trust it to pass the decryption applet (which contains your decryption key). In security more doesn't always equal better. – u2702 Jul 23 '13 at 16:24
  • Applet does not have to contain decryption key, it can access HSM via some secure api... That's how mainly digital signing on web based systems work, accessing smartcard reader via some dll's. – damiankolasa Jul 24 '13 at 6:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.