Skip to content
This repository has been archived by the owner on Aug 28, 2020. It is now read-only.

Commit

Permalink
Update README.md
Browse files Browse the repository at this point in the history
  • Loading branch information
@ziyan
ziyan committed Apr 16, 2014
1 parent bfdabec commit a67bd70
Showing 1 changed file with 5 additions and 0 deletions.
5 changes: 5 additions & 0 deletions README.md
View file
Expand Up @@ -6,3 +6,8 @@ RSA encryption with javascript
* relies on jsbn library from Tom Wu
http://www-cs-students.stanford.edu/~tjw/jsbn/

Security
--------

This is a pet project done a long time ago just for fun. In general, don't do cryptography in javascript, see:
<http://www.matasano.com/articles/javascript-cryptography/>

1 comment on commit a67bd70

@jcmckeown
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I see what matasano or nccgroup are getting at, but... there is a use-case for javascript cryptography; specificially: a securely-delivered polyfill client for decrypting things that the server doesn't have plaintext for. Put another way, it's good for tunnelling pgp communications through a tls connection, to a browser that doesn't have pgp support built in. One can then trust that the javascript arrives untampered; one can't trust that the plaintext of what's in pgp won't be harmful, if its treated as javascript itself --- which means: you shouldn't insert unescaped decrypted pgp into the client browser's DOM.

Please sign in to comment.