peculiarventures / webcrypto-local

webcrypto-local is a cross platform service that provides access to PKCS#11 implementations over a protocol we call webcrypto-socket.

webcrypto-local

webcrypto-local is a cross platform service that provides access to PKCS#11 implementations over a ProtoBuf based protocol we call webcrypto-socket. It provides for message confidentiality and integrity via 2key-ratchet and implements a security policy mechanism that allows the user to approve which peers can interact with it.

webcrypto-socket

Build

npm run build

Tests

npm test

C++ Node.js Addons

This project uses C++ Node.js addons. When building on Node.js 20, you may encounter issues with node-gyp. It is recommended to use node-gyp version 10 or higher to avoid these issues.

If you're using nvm to manage Node.js versions, you can switch to Node.js 10 by running nvm use 10. If you don't have Node.js 10 installed, you can install it by running nvm install 10.

Please ensure that you have the necessary build tools installed on your system to compile C++ code. On Windows, you can install the necessary build tools by running npm install --global --production windows-build-tools. On Unix-based systems, you'll need to have gcc and make installed. You can install these by using your system's package manager.

Related

• 2key-ratchet
• pvpkcs11
• node-webcrypto-p11

webcrypto-local's Issues

The application should not be co-mingled into the regular project

There should be a folder for an application or examples, and the entire UI stuff, readme and all should be in there.

They should not be mixed in like they are.

Update UI to provide example CSR and KEY also

Is first country supposed to be grey?

UI: Insert token prompt needed

Need to determine how we will enable pin/password prompts for key usage.

This is a complicated one, right now our server is running in the current user context because we are doing development. As such it is interactive and can display user interface.

When we switch to it running as a service it will no longer be able to do that.

The various PKCS#11 implementations we will have will want the ability to present pin/password prompts. For them to do so there will need to be an interactive component that invokes the provider.

One way to do this is to use webcrypto-local on the service and have it invoke a session to a user mode "server" that invokes node-webcrypto-p11. We would want to automate the establishment of the pairing between the two components if we did this approach.

We will also need to consider how to handle multi-user systems with this also.

Though solving this problem will require some refactoring, I suggest we continue on the current path and come back to it.

Do we need to introduce a test signing feature?

Creating Certificate Request

If we create Request for certificate with RSA-OAEP key we cannot use this key for request signing

@rmhrisk What should we do for this case?

Need to update certificate view to include certificate details

Right now we don't provide disambiguating information about the certificate:

In general extensions and issuer name would help:

Country field empty error when not empty

Seems related to using first item.

UI incorrectly downloads certificate request as certificate

The "Create" page creates a certificate request.

Downloading the certificate request gives us a .cer

It should be ".csr" or "p10" with a mime type of:
application/pkcs10

We need to disable RSA-OAEP as an available signing option for now

We cant do RSA-OAEP without having a certificate to sign it with so for now lets just disable or remove it.

Need to design a certificate selection dialog

We will need an API to select certificates that match an application's criteria, we are tracking that here: #4

This bug is to track designing a dialog for that API to use, here are some mocks to seed that process:

It would also make sense to have a confirm prompt:

We may also want to have basic smart card support:

These dialogs are inspired by: https://blogs.technet.microsoft.com/dodeitte/2015/05/31/how-to-change-the-certificate-store-used-for-lync-client-certificates/

Multi sessions for pkcs11 modules

@rmhrisk

I've got some problems with opening multi sessions for one PKCS#11 token.

SoftHSM module throws error Error: CKR_USER_ALREADY_LOGGED_IN:256
Yubico module throws error Error: CKR_SESSION_COUNT:177

node-webcrypto-p11 uses

const mod = graphene.Module.load()
mod.initialize()

I can't use initialize twice for one module, even I use Module.load for each time. Because JS load native module only once.

To fix it we have to load native in its own thread for each new Module.load

if we use current version of node-webcrypto-p11, then user can enter PIN only once and use this PKCS11 session for each 2key session.

Screen layout issue on small screens, should ... be right justified?

Also div not covering whole screen

When UI switches to mobile and there are no items we need back button or to incorporate actions

This:

Or This:

Unable to import CSR

When I go to import a CSR in PEM encoding I get an error in the console:

But the UI displays no error, I would have expected a message like:

An error occurred while importing a certificate. 
Please make sure the certificate is well formed and try again.

But I also would have expected this import to actually work, I tried again with the same certificate encoded as DER though the certificate did not get imported it also did not get an error.

We can do a basic check on the provided certificate to see if it is ASCII to determin if we should DER encode before passing to PKIjs. One simple way is via a regular expression:

/^[ -~\t\n\r]+$/;

You could also check for the PEM Armour?

http://stackoverflow.com/questions/30322774/how-do-we-validate-the-format-of-the-csr-using-regex

And based on that decide what is needed to be done.

Either way we need error handling in the UI for errors.

Only the first field (host name/common name) should be required

NPM script error: npm run build:ts

branch: application

User interface needs to poll server when offline so it can detect when it comes online

Right now you have to refresh to detect the server starting, we will need to implement a poll to catch the server start.

Update createCertificate saga

importCert in x509 form is odd because we create PKCS#10 request. This call will throw error for each time
https://github.com/PeculiarVentures/webcrypto-local/blob/application/src/app/sagas/webcrypto/certificate.js#L100

After a succesful or failed paring from the server perspective, the client should be notified

Right now the client basically polls the server to see if its done, it should instead wait on an event from the server to tell it to continue or give up.

User interface needs to handle errors from the server

There will be cases where the server fails for unexpected reasons, right now we have such a case because a smart card is not supported, for example:

In this case, the UI made a call and the server complained:

The UI should catch such cases and display a generic error, something like:

An error occurred trying to access the remote cryptographic implementation.

Please try again.

We could maybe include the stack in a text box so people could copy it and paste it into a support forum.

Info->General

Improve visual style of provider combo

Need to design a certificate selection API

In Windows they have an API called CertSelectCertificate(), it takes a set of criteria and filters certificate to those that match that set.

We will want to have a similar API to make it easy to pick the certificates that match an applications criteria.

In theory, this API would take in a CertificateStorage array and return a certificate, things it might also take as input include:

	OID
title	A string that contains the text for the title of the dialog.
subTitle	A string that contains the text for the subtitle of the dialog.
EKU	A string representation of an object identifier (OID) for an enhanced key usage (EKU). If an OID is provided, only certificates that include this EKU will be displayed.
KU	An array of desired key usages. If a value is provided, only certificates that include all of the values will be displayed.

These values would be used by something like the dialog proposed in #5

We should also consider how we can make this a re-usable component, maybe do it as a WebCompontent?

Mozilla 2key-ratchet

2key-ratchet works for Mozilla, but IndexedDB storage doesn't keep Identity keys for next connection. User has approve each new connection.

Error: Sending multi requests to server using Promise.all

Improve pin generation algorithms

Currently, the project combines two public keys together, hashes them, HEX's that hash, and takes the numbers.

It is better to take the last n bits or first n bits, and convert them into decimal.

parseInt(binary, 2);

This is because HEX will have a bias in its output, this change will make the pins far more random.

We will need to update SECURITY.md.

Review protobuf usage to ensure saftey from manipulation

https://medium.com/@marin_m/how-i-found-a-5-000-google-maps-xss-by-fiddling-with-protobuf-963ee0d9caff#.sjbhgghdr

Lets remove 1024 bit RSA from the UI

It is insecure, and deprecated, lets not expose:

Lets add 3072 to RSA

Right now we do not show 3072, we should

Lets add key size to certificate tile

We want to provide enough information to disambiguate if we can, key size could help:

Need to design a pairing pin prompt

Our pairing mechanism requires the application to present the user a pin it compares to a pin displayed by the operating system for the webcrypto-local service.

Here is a rough prototype we can use as an input to this process:

We will want this to display as a DIV dialog so it can automatically be dismissed when the pairing is complete.

We may end up needing a user mode component to perform cryptographic operations, if so we may also want a pairing confirmation dialog:

UI: Need UI for errors

We have several error cases:

• The requested operation is not supported by the cryptographic provider.
• The requested operation was denied by the cryptographic provider.
• The token or smart card was removed.
• An unknown error occurred.

UI: Provider selector is needed

For operations like generate, import we need to select Provider which will keep new item.

Need to determine how to handle sign and encrypt certificates

WebCrypto does not allow the same key to be used for both signing and encryption, certificates sometimes are used for both.

We have to choose to have webcrypto-local enforce this restriction or to accommodate the certificate usage pattern.

Initially, I suggest we honor the more restrictive WebCrypto approach and change if it becomes a problem.

The reason WebCrypto enforces this rule is to prevent accidental cryptographic mistakes, some algorithms will leak key details if used in the way certs allow.

Need to evaluate empty on value change?

Not sure why we need this provider prompt, it also is empty and does not work.

Need to show online/offline indicator in small screen views

The user doesn't know why button is disabled:

Initial state for connection status should be Yellow and "Searching for server"

Create a protocol flow for webcrypto socket

ex: https://tls.openmirage.org

Hostname to Common Name

Tab order on create page is not right

I should be able to fill out form only with keyboard, I can not open/set get the combo boxes to have focus

Copy to clipboard does not work

The UI should poll the server periodically and update the online status

Need to scrub data returned to client to minimize leakage

Right now we leak a bunch of data to the browser session, we may want to have a debug mode where an admin user can enable this detail or an explicit message to request it that must be approved by the user but by default we want to return only what is minimally needed to perform task.

Move communication to the service into a ServiceWorker

Any application running in the context of the application will have the ability to directly use the IdentityKey.

I believe, if we put the IdentityKey (and other keys) in a service worker, then only whatever API that is exposed by the service worker will be able to interact with those keys.

Since we utilize non-exportable keys, even if we do not do this they can not steal the key but they could create their own pre-keys (or other keys) and get them signed then use them elsewhere.

My moving these keys to the ServiceWorker and using PostMessage to communicate with it we mitigate this risk.

We should add this to our SECURITY.md also.

We should add signature details to requests

We should put the same signature details section in the requests UI:

Expected to see keys, certificate requests and CSRs

Stepan,

I generated some CSRs, that of course generated keys but I do not see keys in the list, is that expected?

Small screen layout issue