1083854 - The library CryptoJS /shared/js/crypto.js is packed

Status: RESOLVED DUPLICATE of bug 1083800

(Firefox OS Graveyard :: Gaia, defect)

Description

[Wilfred Mathanaraj [:WDM]]

Impact: Auditing and reviewing is hard. This is not truly free software.

Fix: We should provide the non-minified version. Minification can and should be done in a build-step, if required. (replace with web crypto instead?)

Comment 1

[marta]

Where can we find documentation on how to use Web Crypto API? Current MDN web page does not provide any information

Comment 2

[Wilfred Mathanaraj [:WDM]]

does this get resolved by Frederik and Tim's answers?

Comment 3

[Paul Theriault [:pauljt] (no longer reading bugmail)]

Hey marta, Tim Taubert has some good example code here for a simple hash: https://github.com/ttaubert/secret-notes/blob/master/02-integrity/storage.js

There are some slides where which explain the background: https://timtaubert.de/blog/2014/09/keeping-secrets-with-javascript/

I have an rough example here which uses PBKDF2 to save and check a password which may help (but hasn't been reviewed by anyone so don't take it as best practice)

aurora: http://jsfiddle.net/1wb8mnd0/2/
Nightly: http://jsfiddle.net/1wb8mnd0/3/

(the difference is that in Nightly you need to mark a key with "DeriveBits" instead of "DeriveKey")

This was just me testing it though, I'd suggest you double check this with Tim Taubert (irc: ttaubert), or Richard Barnes (irc: rbarnes)

Comment 4

[Frederik Braun [:freddy]]

I think this can be resolved via 1083800.