Live data from Hacker News

Stanford Javascript Crypto Library

crypto.stanford.edu

51–60 of 91 posts

Re: Stanford Javascript Crypto Library

#51
post #20

Anyone interested in signed JavaScript? Initiatives like this are great. However, I'm most interested in signed JavaScript. I'm surprised that there isn't more of a discussion going about this since JavaScript crypto is near worthless if it's served from an untrusted server. For example, let's say that you have an application that uses client-side crypto in JavaScript. Then let's assume that the server (that serves u…

It occurred to me the other day that it should be pretty simple to write a script that gets loaded first on the page and removes all subsequent scripts, then loads them itself, checking the MD5/SHA1 of the script against a known good value, stored in that script's attributes.

    
    
Then you could decide to not load scripts that do not match the correct hash. It could even ping the server to alert it to broken scripts.

Re: Stanford Javascript Crypto Library

#52
post #46
post #20

Anyone interested in signed JavaScript? Initiatives like this are great. However, I'm most interested in signed JavaScript. I'm surprised that there isn't more of a discussion going about this since JavaScript crypto is near worthless if it's served from an untrusted server. For example, let's say that you have an application that uses client-side crypto in JavaScript. Then let's assume that the server (that serves u…

If you don't trust the server, you're screwed anyway.

Consider CDNs and static content domains. It's generally easier to break or MITM a CDN or static content server without people noticing. This way, you could trust that the code you received was what you were expecting.

Re: Stanford Javascript Crypto Library

#53
post #51
post #20

Anyone interested in signed JavaScript? Initiatives like this are great. However, I'm most interested in signed JavaScript. I'm surprised that there isn't more of a discussion going about this since JavaScript crypto is near worthless if it's served from an untrusted server. For example, let's say that you have an application that uses client-side crypto in JavaScript. Then let's assume that the server (that serves u…

It occurred to me the other day that it should be pretty simple to write a script that gets loaded first on the page and removes all subsequent scripts, then loads them itself, checking the MD5/SHA1 of the script against a known good value, stored in that script's attributes. Then you could decide to not load scripts that do not match the correct hash. It could even ping the server to alert it to broken scripts.

How would this protect you against a malicious server?

Re: Stanford Javascript Crypto Library

#54
post #53
post #51

Earlier quoted context omitted.

It occurred to me the other day that it should be pretty simple to write a script that gets loaded first on the page and removes all subsequent scripts, then loads them itself, checking the MD5/SHA1 of the script against a known good value, stored in that script's attributes. Then you could decide to not load scripts that do not match the correct hash. It could even ping the server to alert it to broken scripts.

How would this protect you against a malicious server?

If the server serving the HTML is pwnd, then it doesn't, but it doesn't really matter then, either.

This protects against any external scripts being unexpectedly modified, e.g. someone MITM your jquery source.

Re: Stanford Javascript Crypto Library

#55
post #54
post #53

Earlier quoted context omitted.

How would this protect you against a malicious server?

If the server serving the HTML is pwnd, then it doesn't, but it doesn't really matter then, either. This protects against any external scripts being unexpectedly modified, e.g. someone MITM your jquery source.

I guess that's true, but in practice XSS is a much bigger threat to your application than someone MITM'ing an HTTPS connection to Google's (or whomever's) CDN.

Re: Stanford Javascript Crypto Library

#56
post #42

What do you guys think about a service (think pingdom) that you set up to periodically request a js file from your server and check it against a known good checksum? EDIT: to spell this out, you would, self host the stanford library, for example, and have this service verify it against a known good checksum.

You don't just need to authenticate sjcl.js (or whatever). You need to authenticate every page element that can influence the JS, because JS is malleable. The service you propose won't work.

Well, couldn't checksum the whole page?

I know that creates a big pain in the ass in terms of modifying the page and in terms of making the page dynamic, but bracketing those two concerns -- why wouldn't that work?

Re: Stanford Javascript Crypto Library

#57
post #4

Obligatory quote from http://www.matasano.com/articles/javascript-cryptography/ WHAT ABOUT THINGS LIKE SJCL, THE STANFORD CRYPTO LIBRARY? SJCL is great work, but you can't use it securely in a browser for all the reasons we've given in this document. SJCL is also practically the only example of a trustworthy crypto library written in Javascript, and it's extremely young. The authors of SJCL themselves say, "Unfortuna…

Matasano are experts here; I'm not; but here's my argument:

There's parts of their post that I don't like:

"If you don't trust the network to deliver a password, or, worse, don't trust the server not to keep user secrets, you can't trust them to deliver security code." "How can you do that without SSL? And if you have SSL, why do you need Javascript crypto? Just use the SSL."

I wonder about the implicit threat model. Its too black-and-white for me. In it, you either trust the server or you don't.

But security and privacy, for me, for large numbers of users, is all tradeoffs and games, shades of grey.

Consider: maybe our computers are uploading the private files of everyone who runs Windows to Microsoft. I don't know for sure, but I'd gamble that they aren't. I don't think MS would they take the risk of some security researcher catching the anomalous traffic on the network. The threat of the resulting PR storm would help keep MS honest, at that scale. So I'd expect MS would try pretty hard to fight a government leaning on them to do that.

Lets say that, in future, all data on the worlds most popular social network is encrypted client side. My ID is just a public key, and my browser encrypts all my traffic, using a JS package the social network securely delivers me. (Over SSL. With great care.)

That'd be a similar scenario to MS. I'd be trusting them when I enter my password into the JS they sent me, that is running in my browser. But, again, I'd figure that if they were injecting JS to steal my password, or subtly poison my RNG, and if they were doing that to everyone, probably some security researcher would call them on it. And so, they'd be incentivised not to.

That's a fundamentally different situation to the current one, where if Facebook gives all our data away, its pretty hard for someone outside their organisation to find out. Probably they could gamble on keeping it secret.

So that's why I think the 'Javascript Considered Harmful' post is too strong, in its "you either trust the server or you don't" attitude.

I also think that we aren't going to get anyone using crypto, unless its delivered seamlessly in the browser. There has been good crypto available for years (e.g. GPG on the deskop plugged into thunderbird). But I think we've learned that if its even slightly harder to use, then end users are going to ignore it.

And the way to deliver seamless ease-of-use to a wide audience is on the web. And we badly need easy-to-use privacy these days. So I think it'd be a shame if posts like that discouraged research into JS crypto.

(I can think of other arguments:

e.g. where you want to trust a server now (e.g. to encrypt and backup a document) but decide not to trust it later (decide to abandon the document because in the years since you uploaded it, you think the server/company is compromised - or you ask to be e-mailed the ciphertext)

or regulatory differences: I don't think its the same thing legally to demand or steal a copy of someones server side data, and any server side keys, as it is to demand that the javascript be changed to snoop future passwords as users enter them into their browser application?)

Again, I'm no expert in this area; corrections welcome.

Re: Stanford Javascript Crypto Library

#58
post #50
post #49

Earlier quoted context omitted.

Maybe, maybe not. But if you only rely upon the client-side feature of the app and if code signing is employed, you could safely use the app without fear of potentially your private data being stolen (assuming the original code doesn't send private data to the server).

Well, let me explain my thinking. Suppose we sign https://server.com/sjcl.js . That resource is now tamper-proof in the event that server.com is compromised. But what about the rest of the application HTML/js? For example, an attacker could just say: sjcl = ... And overwrite the library on the client side. Ok, suppose the browser support for content-signing prevents this somehow. The attacker can still modify the app…

A single page web app might be statically delivered and useful... Further, I think it just means that the page that does the crypt/decrypt has to be statically delivered, not the whole app.

EDIT: so..if you had a single page web app, signed or even checksum'd the whole hunk in a known good state, couldn't you then trust the execution of the app? Further if you had an external service (as I propose in a comment below) that validated the signature/checksum couldn't you then trust the whole package?

Re: Stanford Javascript Crypto Library

#59
post #20

Anyone interested in signed JavaScript? Initiatives like this are great. However, I'm most interested in signed JavaScript. I'm surprised that there isn't more of a discussion going about this since JavaScript crypto is near worthless if it's served from an untrusted server. For example, let's say that you have an application that uses client-side crypto in JavaScript. Then let's assume that the server (that serves u…

There needs to be both signed javascript and signed native code plugins for javascript (similar to JNI). Both of these require significant leadership because of the fragmented nature of existing implementations. The upside is an ability to deliver native crypto libraries and other plugins that remove the potential of having its internals introspected or MITMed.

The protections against malicious code have to be there, so it would be the same order-of-magnitude of installing any other browser plugin.

Re: Stanford Javascript Crypto Library

#60
post #42

Earlier quoted context omitted.

You don't just need to authenticate sjcl.js (or whatever). You need to authenticate every page element that can influence the JS, because JS is malleable. The service you propose won't work.

Well, couldn't checksum the whole page? I know that creates a big pain in the ass in terms of modifying the page and in terms of making the page dynamic, but bracketing those two concerns -- why wouldn't that work?

Because if I own your server, I can set it up so that it serves the good file to your pingdom-like service, and corrupted files to everyone else. Or more realistically, I'd do something more targeted, like serving the bad files only to the ip block of my business competitors.
Post reply on HN