安全的Javascript加密库？ [英] Secure Javascript encryption library?

问题描述

我正在搜索一个提供安全加密的javascript库。客户端必须生成一个密钥，并且上传到服务器的所有数据都被加密，所有下载的数据被解密。我需要经过验证的加密方案，只需点击率或CBC就不够了。

I'm searching a javascript library that offers secure encryption. The client has to generate a key and all data uploaded to the server is encrypted, all data downloaded is decrypted. I need an authenticated encryption scheme, just CTR or CBC isn't enough.

我听说过sjcl，但似乎sjcl只能一次加密整个数据。我没有找到一种方法来加密数据。因为上传的文件可能非常大，这种方法是不可行的。我需要像java加密接口那样有两种方法update（）和final（）。

I heard about sjcl, but it seems that sjcl only can encrypt the whole data at once. I didn't find a way to encrypt the data blockwise. Because the uploaded files can be very large, this approach isn't feasible. I need something like the java crypto interface with two methods update() and final().

我发现nodeJS加密库似乎做了我需要的，但是我不知道如何在浏览器端使用它。

I found the nodeJS crypto library that seems to do what I need, but I don't know how to use it on browser side.

我发现google crypto-js，但是这个库似乎没有提供经过身份验证的加密，只是标准模式。

I found google crypto-js, but this library doesn't seem to offer authenticated encryption but only the standard modes.

有没有办法用sjcl块数据加密？在浏览器端使用nodeJS加密库？要用crypto-js认证加密？还是有另一个安全的JavaScript库提供我需要的东西？

Is there a way to encrypt data blockwise with sjcl? To use the nodeJS crypto library on browser side? To use authenticated encryption with crypto-js? Or is there another secure javascript library that offers what I need?

推荐答案

由SJCL部署的CCM的Appart是流密码模式我会仔细看看它，而不只是看看方便的包装。这是开源的，所以在某个地方应该是执行原始密码。

Appart from CCM as deployed by SJCL is a stream cipher mode, I would take a careful look at it and not just look at the convenience wrappers. It's open source, so somewhere there should be the implementation of the raw cipher anyway.

请注意，这不是应该最终被信任的代码。当我尝试为其编写Java包装器时，我很快发现身份验证失败的错误。似乎便利库根本没有认证关联的认证数据。因为它没有与其他图书馆测试，我会敦促你注意没有一些遗漏的bug存在。

Note that this is not code that should be ultimately trusted. When I tried to program a Java wrapper for it I quickly found an error that authentication failed. Seems like the convenience library did not authenticate the associated authentication data at all. As it isn't tested with other libraries, I would urge you to take care there aren't some left over bugs present.

这篇关于安全的Javascript加密库？的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！