node-webcrypto-ossl

A WebCrypto Polyfill for Node in TypeScript built on OpenSSL.

Showing:

Popularity

Downloads/wk

35.9K

GitHub Stars

123

Maintenance

Last Commit

1mo ago

Contributors

18

Package

Dependencies

6

License

MIT

Type Definitions

Built-In

Tree-Shakeable

Yes?

Categories

Readme

node-webcrypto-ossl

License test Coverage Status npm version

NPM

We wanted to be able to write Javascript that used crypto on both the client and the server but we did not want to rely on Javascript implementations of crypto. The only native cryptography available in browser is Web Crypto, this resulted in us creating a node-webcrypto-ossl a native polyfill for WebCrypto based on OpenSSL since at the time Node did not have a native WebCrypto implementation. As of Node 15 however they have added such a interface so you may not need this module any longer.

Table Of Contents

WARNING

At this time this solution should be considered suitable for research and experimentation, further code and security review is needed before utilization in a production application.

Installation

npm

npm install node-webcrypto-ossl;

Clone Repo

git clone https://github.com/PeculiarVentures/node-webcrypto-ossl
cd node-webcrypto-ossl

Install

npm install

Test

mocha

Supported algorithms

Algorithm namegenerateKeydigestexport/importsign/verifyencrypt/decryptwrapKey/unwrapKeyderive
SHA-1X
SHA-256X
SHA-384X
SHA-512X
RSASSA-PKCS1-v1_5XXX
RSA-PSSXXX
RSA-OAEPXXXX
AES-CBCXXXX
AES-CTRXXXX
AES-ECB 2XXXX
AES-GCMXXXX
AES-KWXXX
AES-CMACXXX
ECDSAXXX
ECDHXXX
HMACXXX
PBKDF2XX
DES-CBCXXXX
DES-EDE3-CBCXXXX

2 ECB support is not defined by the WebCrypto specifications. Use of ECB in a safe way is hard, it was added for the purpose of enabling interoperability with an existing system. We recommend against its use unless needed for interoperability.

Using

import { Crypto } from "node-webcrypto-ossl";

const crypto = new Crypto();

Elliptic curve secp256k1

secp256k1 curve is not defined by the WebCrypto specifications. This module implements K-256 curve for ECDSA algorithm.

K-256 curve examples

KeyStorage

To use KeyStorage you should init WebCrypto with directory option. If directory option is missing then keyStorage is null

const { Crypto } = require("node-webcrypto-ossl");

const crypto = new Crypto({
  directory: "key_storage"
})

KeyStorage implements interface of W3 Storage

// generating RSA key
const keys = await crypto.subtle.generateKey({
    name: "RSASSA-PKCS1-v1_5",
    modulusLength: 1024,
    publicExponent: new Uint8Array([1, 0, 1]),
    hash: {
      name: "SHA-1"
    }
  },
    false,
    ["sign", "verify"]
  );

/** 
 * saving private RSA key to KeyStorage
 * creates file ./key_storage/prvRSA-1024
 */
await crypto.keyStorage.setItem(keyPairs.privateKey, "prvRSA-1024");

To get key from KeyStorage

var rsaKey = await webcrypto.keyStorage.getItem("prvRSA-1024");

Threat Model

The threat model is defined in terms of what each possible attacker can achieve.

Assumptions

TODO: ADD ASSUMPTIONS

Threats From A node-webcrypto-ossl Defect

TODO: ADD THREATS FROM NODE-WEBCRYPTO-OSSL DEFECT

Threats From Weak Cryptography

TODO: ADD THREATS FROM WEAK CRYPTOGRAPHY

Threats From Improper Use Of Cryptography

TODO: ADD THREATS FOR IMPROPER USE OF CRYPTOGRAPHY

Bug Reporting

Please report bugs either as pull requests or as issues in the issue tracker. node-webcrypto-ossl has a full disclosure vulnerability policy. Please do NOT attempt to report any security vulnerability in this code privately to anybody.

Rate & Review

Great Documentation0
Easy to Use0
Performant0
Highly Customizable0
Bleeding Edge0
Responsive Maintainers0
Poor Documentation0
Hard to Use0
Slow0
Buggy0
Abandoned0
Unwelcoming Community0
100