search

libp2p / js-libp2p-crypto

The libp2p crypto primitives, for Node.js and the Browser!
https://libp2p.io
Other
81 stars 52 forks source link

WebCrypto is locked up in non secure pages (not loaded from HTTPS) #105

Open daviddias opened 7 years ago

daviddias commented 7 years ago

After seeing reports on js-ipfs:

I went to investigate to find this https://groups.google.com/a/chromium.org/forum/#!topic/security-dev/DtOFo51WFMo

It seems that WebCrypto does require a secure context to run and that is not granted in non HTTPS loaded pages. It has an exception for localhost though.

We have a couple of options here:

I prefer option 2, although it will bloat the size of the bundle (again)..

dignifiedquire commented 7 years ago

wow webcrypto gets worse with every thing I learn about it. This is incredible..

dignifiedquire commented 7 years ago

I have some ideas on alternatives, will update here after some experiments

dignifiedquire commented 7 years ago

In the short term we should adding a warning in any case as the current releases all have this issue

dignifiedquire commented 7 years ago

I am making good progress with my experiments of using asmcrypto.js. Speedwise it looks pretty good and I believe it has everything we need.

mitra42 commented 7 years ago

@dignifiedquire - have you looked at Libsodium ? We've been using that in JS.

dignifiedquire commented 7 years ago

@mitra42 I haven't given it a thorough try yet as we need more than it provides, but I will recheck again what we can use from it, thanks for the reminder

daviddias commented 7 years ago

libsodium is great but it exists in its own universe of crypto, the djb universe. We need to support what go-ipfs does and that means that libsodium isn't enough.

Kubuxu commented 7 years ago

Yes, libsodium is an implementation of what NaCl established in this space so it won't be sufficient.