add client side decryption and encryption

[clach04]

To avoid raw text being sent (for example, http instead of https, or don't trust storage on a server (but some how trust is being delivered...)). Ideally something symmetric.

• [x] Initial decrypt only Proof Of Concept/Prototype in https://github.com/clach04/clipboard-confusion/tree/issues_14_client_side_decryption
• [ ] fix ctrl-enter support - broken with intial POC
• [ ] encrypt support

• [ ] encrypt server side support using https://github.com/clach04/openssl_enc_compat/ (rather than needing https://github.com/clach04/clipboard-confusion/tree/issues_14_client_side_decryption?tab=readme-ov-file#openssl-encrypted-aes-256-cbc-with-pbkdf2)

  • WebCryptoAPI - http://www.w3.org/TR/WebCryptoAPI/ - NOTE only an option for https servers and localhost http
  • https://dev.to/halan/4-ways-of-symmetric-cryptography-and-javascript-how-to-aes-with-javascript-3o1b
  • JavaScript Crypto Libraries - https://gist.github.com/jo/8619441

Optionally add support for server side? Using https://github.com/clach04/openssl_enc_compat Can already serve an encrypted file via Use bash shell process substitution:

cat /etc/os-release |openssl enc -e -aes-256-cbc -in - -out - -base64 -salt -pbkdf2 -iter 10000 | \
    ./clipboardconfusion.py /dev/stdin

and

cat /etc/os-release |openssl enc -e -aes-256-cbc -in - -out - -base64 -salt -pbkdf2 -iter 10000  -pass pass:password | \
    ./clipboardconfusion.py /dev/stdin

Fernet maybe a good format to support, format/container is ascii-armored already. And supports expiration.

Compatibility with existing tools

• openssl

  • Using CryptoJS - https://github.com/brix/crypto-js

    • https://stackoverflow.com/questions/64772232/openssl-encrypt-decrypt-with-cryptojs
    • https://stackoverflow.com/questions/62578705/decrypt-openssl-aes-256-cbc-in-browser-cryptojs
    • https://stackoverflow.com/questions/76172707/encrypt-and-decrypt-using-crypto-js-similar-to-openssl-function-in-php
    • https://github.com/brix/crypto-js/issues/375

  • crypto-es (port of crypto-js) https://github.com/entronad/crypto-es - MIT license

    • https://javascript.plainenglish.io/decrypting-openssl-data-with-javascript-38bbeebc34fc

      • openssl enc -aes-256-cbc -base64 -A < file.txt > secretmsg.b64

        // node decrypt.js -pass:PASS < secretmsg.b64
        import fs from 'fs'
        import CryptoES from 'crypto-es'
        
        if (process.argv.length == 3) {
            const pass = process.argv[2].split(':')[1]
            const data = fs.readFileSync(0, 'utf-8')
            function decodeBase64String(encrypted, pass) {
                var decrypted = CryptoES.AES.decrypt(encrypted, pass)
                var utf8 = CryptoES.enc.Utf8.stringify(decrypted)
                fs.writeFileSync(1, utf8);
            }
            decodeBase64String(data, pass);
        } else {
            console.log('need -pass:PASS');
        }

  • libsodium - varients

    • https://github.com/paragonie/sodium-plus NOTE https://github.com/paragonie/sodium-plus/pull/51/files

  • standford sjcl

    • https://github.com/anirudhvr/aes-demo/ AES-256-CBC and AES-256-CCM unclear license
    • https://gist.github.com/guillaumef/2944e9e9a567cb308639973c90353ace

  • custom

    • https://github.com/mdp/gibberish-aes - only supports CBC AES, MIT license

  • using Web Crypto API

    • https://github.com/browserify/EVP_BytesToKey - old kdf (only) for backwards compat, no encryption support, MIT license
    • https://github.com/lal12/node-openssl-file - old kdf, and encryption (no explicit decryption), MIT license
    • https://medium.com/@yinte1222/js-how-to-use-web-crypto-api-in-frontend-aes-256-file-encryption-with-openssl-equivalent-60abc7180b8a - terrible IV, no salt! openssl enc -aes-256-cbc -nosalt -e -in <input file name> -out <output file name> -K <key in Hex> -iv <iv in Hex> unclear on license
      • https://github.com/benjamin5252/web_crypto_api_example
      • https://benjamin5252.github.io/web_crypto_api_example/
    • https://security.stackexchange.com/questions/214423/how-to-translate-openssl-enc-command-to-nodejs-crypto-api
    • https://github.com/meixler/web-browser-based-file-encryption-decryption - openssl enc/dec with pbkdf2 kdf - GPL3
• age in passphrase mode to avoid need to deal with keys
  • https://github.com/kanru/rage-wasm
  • https://github.com/paulmillr/jage
• zip ae-1/ae-2 https://github.com/gildas-lormeau/zip.js
• Fernet - https://8gwifi.org/fernet.jsp
• Secret Space Encryptor https://paranoiaworks.mobi/sse/formats_specifications.html has a few different formats
  • https://pteo.paranoiaworks.mobi/ text (no hmac?)
  • file with hmac

[clach04]

Consider compatibility with:

• https://github.com/gchq/CyberChef AES
• https://github.com/PrivateBin/PrivateBin
  • From https://github.com/PrivateBin/PrivateBin/blob/2985305dbbf6a1bf6a7b1878544c76c3c7827d74/README.md?plain=1#L10

    Data is encrypted and decrypted in the browser using 256bit AES in Galois Counter mode.

• See https://github.com/clach04/puren_tonbo/issues/4

[clach04]

As I've been working on OpenSSL support in:

• https://github.com/clach04/puren_tonbo/issues/111
• https://github.com/clach04/openssl_enc_compat/issues/1 about to submit prototype for OpenSSL with WebCrypto NOTE one limitation with this is that this only works for localhost with http, needs https deployment to get access to crypto unless use a third party js native lib like jcl libsodium.js, etc.

[clach04]

Test data for OpenSSL:

U2FsdGVkX18NXhFhTlAyvM2jXPu+hhsT344TvO0yLYk=

with password:

 password