Assume I am building a local web application (e.g. browser extension) in HTML5 to encrypt a database locally. Access to the database is controlled by a password and a cryptographic master key is derived from the password using a PBKDF. I want to store the derived master key in memory only while the application is in use so I can encrypt and decrypt records as needed.
I have looked at using sessionStorage for this purpose. The advantage is the key should only be in memory and available to the current browser tab. The key should be deleted if that tab or the browser is closed. The advantage is that if you need to refresh the browser tab it will still have the active session and master key otherwise you would need to re-enter the password each refresh. Refreshing may be a rare occurrence as it is a single page app however.
On reading the sessionStorage specification on W3C there is some concern:
The lifetime of a browsing context can be unrelated to the lifetime of the actual user agent process itself, as the user agent may support resuming sessions after a restart.
Is this talking about an OS restart or browser restart?
What I absolutely want to avoid is having the cryptographic key written to disk where it is very hard to get rid of. Is the above quote saying there is a possibility that the key in the sessionStorage could be stored on the disk as part of the crash recovery/restart process? Or is this restart process usually handled in memory only?
a) Does anyone have any knowledge on how the Tier 1 open source browsers (Firefox, Chromium) handle the sessionStorage and whether the contents could be written to disk, even temporarily in the case of a browser crash?
b) Are there any mitigations to prevent any leak of the key to disk in a browser crash or restart? Are there any about:config
settings that could be used to disable session recovery after a browser crash?
c) Is the safest option to not use sessionStorage at all for storing a key? Or perhaps mitigate the risk by using full disk encryption as well?
Thanks for your help.