Skip to main content

Questions tagged [web-crypto-api]

The Web Crypto API is a JavaScript standard for cryptographic primitives, allowing web applications to do cryptogarphy in the browser.

Filter by
Sorted by
Tagged with
1 vote
1 answer
193 views

CryptoKey with IndexedDB to secure stateless authentication

Stateless authentication using e.g. JWT can be dangerous as they are non-revocable and can leak giving full access. But they are really flexible. I'm considering a scenario where the issued JWT is ...
Szyszka947's user avatar
1 vote
0 answers
63 views

Can parts of WebCrypto AES-GCM be reused between encryptions

I am trying to better understand the processes involved in e2ee using WebCrypto on the browser. I understand that the only real method to use a passphrase to generate a symmetric key on the browser is ...
masimplo's user avatar
  • 111
2 votes
1 answer
785 views

Is the Web Crypto API secure when the server is trusted?

I've heard a lot of people say that the Web Crypto API is not very safe. For example: https://tonyarcieri.com/whats-wrong-with-webcrypto, Problems with in Browser Crypto. However, I'm looking to use ...
asdf3.14159's user avatar
0 votes
1 answer
817 views

X.509 certificate's signature algorithm vs. algorithm used in key derived from it to verify a signature

I have the following from Google's public certs for verifying JWT ID -----BEGIN CERTIFICATE----- MIIDHDCCAgSgAwIBAgIIW4K0b18ff70wDQYJKoZIhvcNAQEFBQAwMTEvMC0GA1UE ...
David Min's user avatar
  • 162
3 votes
1 answer
996 views

SubtleCrypto with non-extractable keys stored in IndexedDB - Cross Origin Usage

In a browser I want to use SublteCrypto (https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto) to create a key pair and store it locally in the IndexedDB (https://developer.mozilla.org/en-US/...
dominik's user avatar
  • 31
0 votes
0 answers
419 views

ESP32: Secure WiFi credentials via WebCrypto?

Background information: I am not a computer scientist. However, in a research project I am currently building a ESP32-based sensor. Multiple sensors of this type are going to be used by multiple users....
reg.cs's user avatar
  • 101
4 votes
1 answer
2k views

Are CryptoKey Objects stored in IndexedDB stored in Plain Text on the users machine?

I'm considering storing a sysmetric encryption key in the form of a CyptoKey Object with extractable set to false in IndexedDB and I was wandering whether this is safe or not. The questions that I ...
AnotherOne's user avatar
2 votes
1 answer
176 views

Is possible to implement a Web Cryptography API custom provider?

I'm reading some basic info about Web Cryptography API and I'm wondering if is possible to implement some crypto provider (C/C++ library or something) with some extra algorithms or is mandatory to use ...
RobertGG's user avatar
-1 votes
1 answer
423 views

Find Confirmation Code (FindBug.io) [closed]

I have solve half of the problem by decoding a base64 code that reveal the next URL(https://app.findbug.io/app/task/FinDBuG-CTF2019) but now i don't know what to find or where i tried it with ...
snowr's user avatar
  • 3
1 vote
1 answer
629 views

Web Crypto API maturity for JavaScript RSA encryption?

We have been using a JavaScript crypto API to do RSA encryption in the browser. I know all the criticisms on encryption in JavaScript but we have evaluated pros and cons of the solution and the risks ...
robob's user avatar
  • 251
3 votes
0 answers
2k views

How can Web Crypto API and IndexedDB protect data stored on the client side against user manipulation?

Imagine web apps that are supposed to work with no or only a few interactions with the web server, for example: a browser game in which the player's level and progress are to be saved locally. a game,...
Steve06's user avatar
  • 131
1 vote
1 answer
116 views

Does the Web Cryptography API prevent a bad server from slurping cleartext?

Consider a cryptographic web application that relies on hosted JavaScript. This JavaScript could be manipulated server-side by a bad actor, defeating any cryptographic tasks. Namely: private keys ...
lofidevops's user avatar
  • 3,610
22 votes
3 answers
5k views

What’s wrong with in-browser cryptography in 2017?

There are many articles in the internet criticising JavaScript cryptography in the browser: "What’s wrong with in-browser cryptography?" by Tony Arcieri "Final post on Javascript crypto" on rdist "...
user1204395's user avatar