Nighttime Peanut Migrations
    Have ideas to improve npm?Join in the discussion! »

    node-webcrypto-ossl
    TypeScript icon, indicating that this package has built-in type declarations

    2.1.2 • Public • Published

    node-webcrypto-ossl

    License Build Status Coverage Status npm version

    NPM

    We wanted to be able to write Javascript that used crypto on both the client and the server but we did not want to rely on Javascript implementations of crypto. The only native cryptography available in browser is Web Crypto, this resulted in us creating a node-webcrypto-ossl a native polyfill for WebCrypto based on OpenSSL.

    Table Of Contents

    WARNING

    At this time this solution should be considered suitable for research and experimentation, further code and security review is needed before utilization in a production application.

    Installation

    npm

    npm install node-webcrypto-ossl;
    

    Clone Repo

    git clone https://github.com/PeculiarVentures/node-webcrypto-ossl
    cd node-webcrypto-ossl
    

    Install

    npm install
    

    Test

    mocha
    

    Supported algorithms

    Algorithm name generateKey digest export/import sign/verify encrypt/decrypt wrapKey/unwrapKey derive
    SHA-1 X
    SHA-256 X
    SHA-384 X
    SHA-512 X
    RSASSA-PKCS1-v1_5 X X X
    RSA-PSS X X X
    RSA-OAEP X X X X
    AES-CBC X X X X
    AES-CTR X X X X
    AES-ECB 2 X X X X
    AES-GCM X X X X
    AES-KW X X X
    AES-CMAC X X X
    ECDSA X X X
    ECDH X X X
    HMAC X X X
    PBKDF2 X X
    DES-CBC X X X X
    DES-EDE3-CBC X X X X

    2 ECB support is not defined by the WebCrypto specifications. Use of ECB in a safe way is hard, it was added for the purpose of enabling interoperability with an existing system. We recommend against its use unless needed for interoperability.

    Using

    import { Crypto } from "node-webcrypto-ossl";
     
    const crypto = new Crypto();

    Elliptic curve secp256k1

    secp256k1 curve is not defined by the WebCrypto specifications. This module implements K-256 curve for ECDSA algorithm.

    K-256 curve examples

    KeyStorage

    To use KeyStorage you should init WebCrypto with directory option. If directory option is missing then keyStorage is null

    const { Crypto } = require("node-webcrypto-ossl");
     
    const crypto = new Crypto({
      directory: "key_storage"
    })

    KeyStorage implements interface of W3 Storage

    // generating RSA key
    const keys = await crypto.subtle.generateKey({
        name: "RSASSA-PKCS1-v1_5",
        modulusLength: 1024,
        publicExponent: new Uint8Array([1, 0, 1]),
        hash: {
          name: "SHA-1"
        }
      },
        false,
        ["sign", "verify"]
      );
     
    /** 
     * saving private RSA key to KeyStorage
     * creates file ./key_storage/prvRSA-1024
     */
    await crypto.keyStorage.setItem(keyPairs.privateKey, "prvRSA-1024");

    To get key from KeyStorage

    var rsaKey = await webcrypto.keyStorage.getItem("prvRSA-1024");

    Threat Model

    The threat model is defined in terms of what each possible attacker can achieve.

    Assumptions

    TODO: ADD ASSUMPTIONS

    Threats From A node-webcrypto-ossl Defect

    TODO: ADD THREATS FROM NODE-WEBCRYPTO-OSSL DEFECT

    Threats From Weak Cryptography

    TODO: ADD THREATS FROM WEAK CRYPTOGRAPHY

    Threats From Improper Use Of Cryptography

    TODO: ADD THREATS FOR IMPROPER USE OF CRYPTOGRAPHY

    Bug Reporting

    Please report bugs either as pull requests or as issues in the issue tracker. node-webcrypto-ossl has a full disclosure vulnerability policy. Please do NOT attempt to report any security vulnerability in this code privately to anybody.

    Related

    Install

    npm i node-webcrypto-ossl

    DownloadsWeekly Downloads

    11,061

    Version

    2.1.2

    License

    MIT

    Unpacked Size

    310 kB

    Total Files

    79

    Last publish

    Collaborators

    • avatar
    • avatar