Re:OpenPGP JavaScript implementation
by sensibletouches on Thursday May 30, 2013 @05:27AM
(#5791595)
> Don't run your nuclear launch codes through this.
Just keep them in your coat pocket:
Thank you for saying it. I find it dangerous to let users believe their data is secure, when the in-js encryption is everything but. It may lead to all sorts of misunderstandings and litigation issues...
https://github.com/eschulte/node-gpg
(a Javascript PGP library that might be safe for nuclear launch codes)
This is not a PGP library. It's a wrapper around gpgme, which in turn is a wrapper around gnupg. node-gpg just exposes the GnuPG command line as javascript functions.
And nodejs is not a javascript server, it's just a wrapper around V8 and the kernel's socket API? Linux is not an operating system kernel, it's just a wrapper around X86?
That distinction is silly.
Nothing is anything. We're all just subatomic particles destined for heat death
But, really:
openpgpjs, the topic of the article, is a program that implements the OpenPGP standard, and the cryptographic algorithms it depends on.
node-gpg, the topic of this comment, does not implement any part of the OpenPGP standard, nor any cryptographic algorithms. It executes a local C program, GnuPG. If you don't have that C program, it does nothing.
Suggesting that they are the same thing is silly. The distinction is massive.
Otherwise, I could claim I just implemented a world-class PGP implementation! To try it out, just run: perl -e "exec 'gpg'"
Both this and GnuPG encrypt and decrypt data with PGP keys. GnuPG, however, does this securely, in many, many senses of the word. For instance, GnuPG maps all of its buffers to protected memory pages, and clears its buffers frequently and early.
A very large portion of GnuPG's code is dedicated to protecting your private keys, and the techniques that they use simply aren't available to javascript.
This doesn't mean the JS library is bad, it's just a good thing to keep in mind. Don't run your nuclear launch codes through this.