A simple tool for storing secrets.
This is under development and has not been audited yet. Currently uses the WebCrypto API, so it only works in modern browsers.
These are the cryptograph flows used by AncientTome:
init: salt + password --(bcrypt)--> hash --(AES-GCM)--> AES key
init: salt + password --(bcrypt)--> hash --(HMAC+SHA256)--> HMAC key
obfuscate keys: plainText --(HMAC+SHA256)--> cypherText
encrypt values: plainText --(AES-GCM)--> cypherText
The salt is randomly generated on first use and stored in plaintext. The password is provided by the user and stored in their head.
If you want to use localStorage
a wrapper is provided for you.
While localStorage
is synchronous, encryption is asynchronous,
so read methods require a callback.
Write methods have an optional callback called on completion.
var AncientLocal = require('ancient-tome/local')
var secureLocalStorage = AncientLocal()
secureLocalStorage.open(password, function(error) {
secureLocalStorage.setItem('journal', 'dear diary...', function(err){ ... })
secureLocalStorage.getItem('bank info', function(err, plaintext){ ... })
})
You can use whatever key-value storage mechanism you want. Reading non-existant keys should return a falsy value, not error. The first argument of callbacks should be the error or a falsy value. Here is a custom storage example:
var AncientTome = require('ancient-tome')
var myTome = AncientTome()
myTome._get = function(key, cb){ ... }
myTome._set = function(key, value, cb){ ... }
myTome._remove = function(key, cb){ ... }
With obfuscated keys, its hard to keep track of what's been stored.
Use the TomeIndexer
to augment a tome with a simple index.
Be sure to do this after if you are overriding get/set methods.
var AncientTome = require('ancient-tome')
var TomeIndexer = require('ancient-tome/indexer')
var myTome = AncientTome()
TomeIndexer(myTome)
myTome.open(password, function(){
myTome.index() //=> ['journal', 'bank info']
})