Is Javascript a proper platform for cryptography?

问题:

I noticed a good while back that Wikipedia links to a Javascript implementation of different hash functions. Also found Clipperz Crypto. Even Mozilla implements a crypto object in Firefox.

So, Is Javascript a proper platform for cryptography? Or, can it be?
Or, I suppose.. Are there any purposes or benefits for hashing data before POST?

回答1:

There are uses for hashing functions in Javascript, for example validating captchas client side (by comparing hash in session to computed hash from input). Obviously, the uses are limited since it runs almost exclusively client side (and you can't trust client input), but the potential is there.

回答2:

You can encrypt data using JavaScript; however I'm not sure about the benefits. Because if you are using, let's say bas64, you need to send the encryption key to the client, and if someone can intercept the encrypted information he/ she would probably be able to intercept the encryption key too.

You should never use this for replacing SSL certificates.

回答3:

Never ever can you use javascript as a safe platform for transferring secure data ...

But it is possible to make a md5 or other type of encryption client-side, that gives you a reasonably secure way of validation you could test server-side !-)

回答4:

These blog articles describe valuable uses for cryptography in JavaScript:

For securely identifying yourself:

http://digitalbazaar.com/2010/08/07/webid/

For providing a secure interface to localhost applications w/embedded-servers via a website:

http://digitalbazaar.com/2010/07/20/javascript-tls-1/

http://digitalbazaar.com/2010/07/20/javascript-tls-2/

回答5:

I dont see why a cryptographic function couldnt be implemented using javascript.

However..Cryptography is a resource intensive process.

Compared to compiled code Javascript is slooooooow.

回答6:

I can see at least one use: If you are sending the client encrypted data, then decrypting it in JavaScript based on a key/password that the user enters locally. This presupposes a shared key or a known password that you used to originally encrypt the data at the server. Also, these functions are frequently used by malicious and/or obfuscated JavaScript.

回答7:

The answer depends on what you want to do.

If you want to use cryptography on client side, off-line, persistent web applications then yes. So for example do you want to encrypt all data that is stored in an embedded database using the HTML 5 specifications 'globalStorage()'. Then use javascript crypto, because the likelihood is that you wont have a connection to handle all the crypto on the server side.

If not use the tried and tested methods