News for hackers. Stuff that matters.

A comment on Javascript encryption. Parent comment

Re:Javascript encryption by dublinclontarf on Sunday July 03, 2011 @09:49AM (#2723677)
SJCL has a bug in their RSA implementation. We're using a good bit of their code with a few changes for our web client. The idea being that we don't want to store passwords, so the webclient stores an encrpyted private key and everything sent to the server must be signed.

The users id is a sha256 hash of their public key and all we keep are the public keys.

Working so far in FF and Chrome, not even trying it in IE

[ Parent | on HN ]
Re:Javascript encryption by xfax on Sunday July 03, 2011 @02:56PM (#2724323)
Are you at liberty to disclose what you're using this for? i'm interested in learning about legitimate use cases for SJCL.
[ Parent | on HN ]
Re:Javascript encryption by dublinclontarf on Sunday July 03, 2011 @10:27PM (#2725167)
The auth system for a stock/asset exchange.
[ Parent | on HN ]
Re:Javascript encryption by yid on Sunday July 03, 2011 @02:06PM (#2724169)
Not sure what you mean, SJCL doesn't have an RSA implementation.
[ Parent | on HN ]
Re:Javascript encryption by dublinclontarf on Sunday July 03, 2011 @10:27PM (#2725164)
Hmmm, indeed it doesn't. Who's RSA implementation am I using, guess I've forgotten.
[ Parent | on HN ]
Re:Javascript encryption by yid on Monday July 04, 2011 @01:26AM (#2725481)
Probably Tom Wu's JSBN implementation...
[ Parent | on HN ]