hi sexy user-level open a really great
American engineer going over it again
yes almost time you have restarted sorry
um mr. no good tactic wait talk to your
patients and painter hear about web
crypto I did after a show of hands of
whom was cartography inclined that a
couple so it was kind of warm web
inclined couple folks alright cool we'll
introduce myself here my name is Kat
Traxler you could call me milk is like
my my day job is web application
penetration testing and I also have some
relevant experience building means back
application this is where I found a love
for JavaScript building Mongo Express
angular know the full stack JavaScript
it's a kind of love a person has when
they see a storm coming and it just
really wanted to go outside and see the
lightning that's John strip for me and I
was always really interested in
photography but I'd really be classified
more of a photography tourists and
anything I just have to go too far to
see a cryptography tourist site because
photography just kind of came to me
huh photography your browser's been
around since you know remind you since
GLS as well but what has changed really
what changed really is client fired
encryption justin is being listed to do
some heavy lifting in your browser
implementation of javascript in your
browser things like the stanford
javascript library the stanford active
crypto library is sought to prove that
there was no reason you could do
cryptographic operations directly in
javascript but there's some there's some
glaring security gaps they're just
inherent to javascript javascript for
example has no strong bindings
javascript cannot value any of its
dependencies additionally javascript
doesn't have any protected variables
representing namespaces furthermore i'm
discussing javascript doing this in the
browser javascript for the web is bound
by its runtime which is the browser
missing and router is an obvious secure
p storage without secure key storage in
the browser this is just the OL mess
that we have to deal with right the
browser is is our OS now without any
security storage why is
photography here in the brown sugar
right like why are we doing this at all
fearsome there's a pretty good reasons
why people are doing it for example
secure document storage multi-factor
authentication protected document it
always done all of these settings
service ID for a long time so the
reasons for this arm special what's
changed is is where it's happening and
why is it happening client-side well it
can be sold to a user as you have more
protection over your day to navigate for
control for the application what happens
when you move encryption client-side is
you limit your burden you know I think I
think they're the fallacy that says that
your application really wants you to
know the contents of your daddy weight
watchers metadata they don't really want
the content to do data if they're served
with a warrant for for your data they
want to be able to limit the liability
and doin client-side encryption is the
perfect way to do that so it's brings us
back to the question what are we asking
JavaScript to do I highlight for four
holes of crypto occasionally there's a
is a triad of gold for a confidentiality
integrity authentication confidentiality
typically in bed encryption you can also
have availability encryption you have
your vehicle description better bringing
some availability
authentication integrity non-repudiation
we need is with max to movies with
public key cryptography digital
signatures but we haven't understand
that all cryptography starts with secure
numbers secure random numbers some keys
must be random some to use need to have
more random bits a turkey sub keys need
to be unique we adopted two assaults
these are all cryptographic operations
that require a secure random number so
how does java script attempt to overcome
its lack of a secure reading number
generator its lack of secure random as
you might see in jemison there's two
different approaches and talked about
here one of the approaches actually says
we can't trust JavaScript animal to
Jesus so I'll mention the first the
Stanford ejector crypto library the
first real solution to this problem as
JavaScript library devised a solution
for collecting entropy from events that
happen in the browser on click on mouse
over on board on key from these are
combined with the times that even has
occurred they run it through a bright
white main function and you have a
fairly decent sort of entropy the other
the other method for obtaining secure
random in a browser is what we're doing
again and what's the whipped cream to
API says is we can't trust JavaScript at
all to handle this we are going to reach
outside of the browser for entropy and
those cryptographic operations are
performed natively in your hardware so
that does a commentary not on the source
of the interference I another service
not the quality of the hitter Peavy
visual gain from event-driven model but
it really is a commentary on the secure
secure solace so a dense tying for the
source of entropy is only as good as you
can pick up those times and events and
what I'm trying to impress upon
everybody is that really can't trust
much that happens with a browser so I'm
gonna give me a little bit of overview
of the web crypto API so the web crypto
API working group so it developed a
method like instead of obtaining secure
random outside of the browser I guess it
said you can't trust anything that
happens in the browser these events
these mouse clicks we're ready to
provide a source for developers to do
this securely photography in a browser
was happening but also javascript in the
browser needed access to these the
ability to direct these petrographic
operations what's really missing from
the web crypto API is any sort of
direction I'm going to start out by
taking us down a bit of a fictional path
we're going to do a thought experiment
here in Riverton were developer and
we've been tapped with the idea of
creating a feature and we're going to be
encrypting a document for a user and the
user needs to later decrypt this
document so we're left with a few
methods we
eat encrypt decrypt sign verify we're
asking whether to API by the crystal
meth fuddles interface and the creators
of the limiter to allah AAP i meant to
say subtle as a hint to everybody that
maybe some operations have some subtle
impact but as this is sal for the same
we're going to start out we're going to
crip the document by person a key let's
let's take a look at your hankies and
when we when we generate a key through
the web crypto API we have we have a few
choices that were presented with and the
web crypto API attempts to limit our
abilities to share some foot right so
when you are creating a symmetric key
the only algorithm vailable is a yes
that's all we have in fact if you don't
want to specify a healing when creating
a key 256 is what if you folks to in
addition you need to indicate if this
key is going to be structural or not and
this usages now whether or not what bold
you tune of aes this this choice is
definitely sold piffle and then the
skirts of choices right here and just
saying that it's not a unique problem to
web crypto however whether or not a key
is extracted a lot of browser is very
unique and so this is what makes makes
us knew a little more on what's created
when we are going to creating the
symmetric key when what a create a
symmetric key this object that we're
going to be creating it it's going to be
a little bit object it's not going to be
available to access I
it's not going to be available to the
access or stored in mobile stores we can
save as a cookie we're not going to be
allowed to write it can you read only
object value if not actually if you
don't the browser if we want to create
it as an honest for logic it's going to
be tied specifically to that browser
that is created in the web crypto API
have not through the rules of the web
when you create a keen with a Webster to
API the same origin policy applause so
you can't send this key consummated now
I put a big caveat around you cancel the
key consummated because crafter main web
requests happen every day in that
through thing called course on the cross
origin resource policy so if a
application implement scores incorrectly
and create this web crypto key as an
extractable key it can certainly be
signs constantly so you've created a key
for fictitious feature and maybe we
should created not exceptional
extractable needs that we could send it
we can transmit as keen on extractable
mean but I need to lid an industry be so
maybe we keep it not accessible and keep
it at the safety first choice we would
we do with this key now that we haven't
you probably become want to use a
transcript or document that make sense
so we're going to encrypt the key we're
going to prepare document with this
symmetric keys and we're going to keep a
keen on for loan we're going to keep it
tucked away in our index TV and our
users document can be encrypted it
because onto the server to be saved and
we have a perfectly good encryption
scheme but something let me go steam
right here and maybe some folks are
following along with this
um Becky to the decrypt the document of
hanging out in SCV index DB is not going
to hang around forever the user can
certainly clear and xev and third or
their documents gone this is not a new
schoolteacher where workers can combine
clear out and xev so what's going to
actually happen in practice this
adventure kita we created to encrypt the
documents and we thought it'd be a
really safe right hand to keep it non
extractable so it can't be sent across
today and I don't actually have to have
to make it accessible because we're
going to use another function of the web
crypto API and we're going to wrap it so
we're going to create a key from user
credentials and we'll wrap this key and
going to send along with the document
and then it'll be returned and can
unwrap the key and then either to give
it up in it unwrapping unwrapping a key
it was very confident together practice
and there's there's a fun function on
the web crypto API that actually allows
you to change a team's usage of a moment
so the workers way see I really tried
hard to prevent us from shooting
yourself in the foot however at that
moment we could specify the key to be
assigning key which if you know anything
about retired is a horrible idea to do
with the keys that is also new Jim Crow
and we're not all so we're not also
going to be using the web crypto API
dramatically I'm sorry this this pathway
alleging down actually definitely happen
to practice what happens in practice is
developers use libraries that are
abstraction layers and here's just a
handful of the libraries that have
sprung up to support web crypto
forged am clever ge'ez polyfill anthem
Chris open PJ pjs and some of these tell
themselves is pure JavaScript
implications and if you ever see those
words pure JavaScript implementation you
know that it is a venture to model it's
not calling with crypto API indirectly
what most of those libraries do is
they're actually more of a hybrid so I'm
going to highlight three different
libraries I'll talk about to be
different libraries and I have is just a
chunk of code up here because if I
thought it was the most egregious coming
the trip clip Virginia clipper Jas is a
browser extension password manager is
really healthy they never know what your
data your data is never sensitive
servers unencrypted while they are pure
JavaScript annotation a driver source of
entropy from user events then there's a
more of a hybrid method which I have up
here so petite PG PG as proton nailed
actually the maintainer event open
source project right now adulterous the
town to access the web crypto if you
have project the web crypto API and then
it thinks maybe maybe I'm hanging up ms
node server maybe I should get my
service that i'm free from this node
object now finally okay well maybe
whoever called assumption has a random
buckle and maybe i will use that for my
entropy so if anybody here has some
wonderful ideas about server side
includes or any kind of javascript
injection to this we should talk
afterwards because this is kind of
really excited and the last kidero
mentioned is TK ideas PK jazz does have
a strict web crypto API implementation
however under get how they do they do
their library somewhat limiting and
you're probably going to actually have
skews ish in they print you directly
physician you're probably have to use
make your features and usable so what do
I have to say at all this by so take
ways that I hope you have our that her
turkey complicated stuff right and the
way software in pinellas is as people
built it and then they tested and they
fix that intelligent bracelet making
builds anymore and somebody's you know
insecure random number generator never
broken any buddies out is that the playa
sale and if you find yourself reviewing
some web crypto and it seems like
variable missing everything right if
don't don't worry and ready to just
break the climate