Skip to main content

Questions tagged [web-crypto-api]

The Web Crypto API is a JavaScript standard for cryptographic primitives, allowing web applications to do cryptogarphy in the browser.

Filter by
Sorted by
Tagged with
1 vote
1 answer

CryptoKey with IndexedDB to secure stateless authentication

Stateless authentication using e.g. JWT can be dangerous as they are non-revocable and can leak giving full access. But they are really flexible. I'm considering a scenario where the issued JWT is ...
Szyszka947's user avatar
1 vote
0 answers

Can parts of WebCrypto AES-GCM be reused between encryptions

I am trying to better understand the processes involved in e2ee using WebCrypto on the browser. I understand that the only real method to use a passphrase to generate a symmetric key on the browser is ...
masimplo's user avatar
  • 111
2 votes
1 answer

Is the Web Crypto API secure when the server is trusted?

I've heard a lot of people say that the Web Crypto API is not very safe. For example:, Problems with in Browser Crypto. However, I'm looking to use ...
asdf3.14159's user avatar
0 votes
1 answer

X.509 certificate's signature algorithm vs. algorithm used in key derived from it to verify a signature

I have the following from Google's public certs for verifying JWT ID -----BEGIN CERTIFICATE----- MIIDHDCCAgSgAwIBAgIIW4K0b18ff70wDQYJKoZIhvcNAQEFBQAwMTEvMC0GA1UE ...
David Min's user avatar
  • 162
3 votes
1 answer

SubtleCrypto with non-extractable keys stored in IndexedDB - Cross Origin Usage

In a browser I want to use SublteCrypto ( to create a key pair and store it locally in the IndexedDB (
dominik's user avatar
  • 31
0 votes
0 answers

ESP32: Secure WiFi credentials via WebCrypto?

Background information: I am not a computer scientist. However, in a research project I am currently building a ESP32-based sensor. Multiple sensors of this type are going to be used by multiple users....
reg.cs's user avatar
  • 101
4 votes
1 answer

Are CryptoKey Objects stored in IndexedDB stored in Plain Text on the users machine?

I'm considering storing a sysmetric encryption key in the form of a CyptoKey Object with extractable set to false in IndexedDB and I was wandering whether this is safe or not. The questions that I ...
AnotherOne's user avatar
2 votes
1 answer

Is possible to implement a Web Cryptography API custom provider?

I'm reading some basic info about Web Cryptography API and I'm wondering if is possible to implement some crypto provider (C/C++ library or something) with some extra algorithms or is mandatory to use ...
RobertGG's user avatar
-1 votes
1 answer

Find Confirmation Code ( [closed]

I have solve half of the problem by decoding a base64 code that reveal the next URL( but now i don't know what to find or where i tried it with ...
snowr's user avatar
  • 3
1 vote
1 answer

Web Crypto API maturity for JavaScript RSA encryption?

We have been using a JavaScript crypto API to do RSA encryption in the browser. I know all the criticisms on encryption in JavaScript but we have evaluated pros and cons of the solution and the risks ...
robob's user avatar
  • 251
3 votes
0 answers

How can Web Crypto API and IndexedDB protect data stored on the client side against user manipulation?

Imagine web apps that are supposed to work with no or only a few interactions with the web server, for example: a browser game in which the player's level and progress are to be saved locally. a game,...
Steve06's user avatar
  • 131
1 vote
1 answer

Does the Web Cryptography API prevent a bad server from slurping cleartext?

Consider a cryptographic web application that relies on hosted JavaScript. This JavaScript could be manipulated server-side by a bad actor, defeating any cryptographic tasks. Namely: private keys ...
lofidevops's user avatar
  • 3,610
22 votes
3 answers

What’s wrong with in-browser cryptography in 2017?

There are many articles in the internet criticising JavaScript cryptography in the browser: "What’s wrong with in-browser cryptography?" by Tony Arcieri "Final post on Javascript crypto" on rdist "...
user1204395's user avatar