Comments (5)
Does that help clarify?
Thanks, yes.
Agree with your proposal for @peculiar/webcrypto.
from cryptography-and-security.
A couple of questions to better understand the need for webcrypto
:
- Am I correct that we do not need
webcrypto
in the browser, because they have a native implementation? - Do we still need it in Node, given that Node has a
crypto
library which covers the same functionality?
Can't we just switch to Node.js shims that delegate to Node crypto
? cfr. https://npms.io/search?q=webcrypto
from cryptography-and-security.
@RubenVerborgh excellent questions.
Am I correct that we do not need webcrypto in the browser, because they have a native implementation?
Correct, yeah. The webcrypto
shims are just for the Node.js side (and they all use Node's native crypto
under the hood), to enable isomorphic libraries that use the same code in the browser and on the server. (That said, implementation coverage of the WebCrypto API is not uniform across all browsers, so it's the usual situation of - sometimes you need polyfills in certain browsers.)
So there's two main questions here:
- Does the Solid ecosystem need some kind of WebCrypto shim? and,
- If yes, should it be the
@trust/webcrypto
implementation, or some other one.
Here are my thoughts on this:
Does the Solid ecosystem need some kind of WebCrypto shim?
I would recommend - yes. As long as the Solid ecosystem uses both Javascript in the browser and Node.js or TypeScript on the server, AND we do anything with cryptography, there is considerable advantage to writing middle and higher level code on top of the WebCrypto API, and being able to run it isomorphically. This is a conclusion that both Solid and many other projects have come to.
So, currently, the JOSE library that Solid uses is isomorphic, and is used in all auth-related libraries, browser side and server side.
If yes, which WebCrypto shim library should Solid use?
So actually, I would recommend against @trust/webcrypto
at this point in time, and would recommend that Solid switches to the @peculiar/webcrypto
implementation (which looks like it was inspired by @trust/webcrypto
, but is more actively maintained, and is rewritten in TypeScript).
Up until recently, the isomorphic-webcrypto
package used @trust/webcrypto
as a server-side shim. And all the other projects that I've encountered in the wild just used isomorphic-webcrypto
.
But now I see that isomorphic-webcrypto
switched its dependency and uses @peculiar/webcrypto
on the server side instead. And I think we should follow suit.
Does that help clarify?
from cryptography-and-security.
It seems like as straightforward of a wrapper as it could be and covers more than just "these were the algorithms we needed - everything else TBD". @peculiar/webcrypto-core
does a good job of validating all of the inputs and not just passing things straight through to node's crypto implementation blindly.
from cryptography-and-security.
This issue has been resolved -- the 4 Solid libraries that were using @trust/webcrypto
have been updated to use isomorphic-webcrypto
instead.
(Also, those libraries will be deprecated going forward anyway.)
Closing this issue.
from cryptography-and-security.
Related Issues (5)
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from cryptography-and-security.