Is Javascript a proper platform for cryptography? Or, can it be?

Question

I noticed a good while back that Wikipedia links to a Javascript implementation of different hash functions. Also found Clipperz Crypto. Even Mozilla implements a crypto object in Firefox.

So, Is Javascript a proper platform for cryptography? Or, can it be?
Or, I suppose.. Are there any purposes or benefits for hashing data before POST?

Answer 1

I dont see why a cryptographic function couldnt be implemented using javascript.

However..Cryptography is a resource intensive process.

Compared to compiled code Javascript is slooooooow.

Answer 2

You can encrypt data using JavaScript; however I'm not sure about the benefits. Because if you are using, let's say bas64, you need to send the encryption key to the client, and if someone can intercept the encrypted information he/ she would probably be able to intercept the encryption key too.

You should never use this for replacing SSL certificates.

Answer 3

There are uses for hashing functions in Javascript, for example validating captchas client side (by comparing hash in session to computed hash from input). Obviously, the uses are limited since it runs almost exclusively client side (and you can't trust client input), but the potential is there.

Answer 4

Never ever can you use javascript as a safe platform for transferring secure data ...

But it is possible to make a md5 or other type of encryption client-side, that gives you a reasonably secure way of validation you could test server-side !-)

Answer 5

I can see at least one use: If you are sending the client encrypted data, then decrypting it in JavaScript based on a key/password that the user enters locally. This presupposes a shared key or a known password that you used to originally encrypt the data at the server. Also, these functions are frequently used by malicious and/or obfuscated JavaScript.

Answer 6

The answer depends on what you want to do.

If you want to use cryptography on client side, off-line, persistent web applications then yes. So for example do you want to encrypt all data that is stored in an embedded database using the HTML 5 specifications 'globalStorage()'. Then use javascript crypto, because the likelihood is that you wont have a connection to handle all the crypto on the server side.

If not use the tried and tested methods

Answer 7

These blog articles describe valuable uses for cryptography in JavaScript:

For securely identifying yourself:

http://digitalbazaar.com/2010/08/07/webid/

For providing a secure interface to localhost applications w/embedded-servers via a website:

http://digitalbazaar.com/2010/07/20/javascript-tls-1/

http://digitalbazaar.com/2010/07/20/javascript-tls-2/