node-webcrypto-ossl was created in 2015 because at the time the Node team did not feel the need to have two crypto interfaces and they already had one before WebCrypto was defined.

That position has since changed since Node16.x (2021-10-26) there is a LTS build of Node that supports the WebCrypto interface.

We have also since created @peculiar/webcrypto which no longer has the direct dependency on OpenSSL which makes it much easier to support in the wild. This package supports a number of algorithms that are not supported by standards compliant webcrypto implementations.

This allows applications to retain maximal code compatibility with standards while maintaining interoperability with systems that rely on these other algorithms. For those who have this requirement we recommend moving to @peculiar/webcrypto.

We wanted to be able to write Javascript that used crypto on both the client and the server but we did not want to rely on Javascript implementations of crypto. The only native cryptography available in browser is Web Crypto, this resulted in us creating a node-webcrypto-ossl a native polyfill for WebCrypto based on OpenSSL since at the time Node did not have a native WebCrypto implementation. As of Node 15 however they have added such a interface so you may not need this module any longer.

• WARNING
• Installing
  • Clone Repo
  • Install Dependencies
  • Install
  • Test
• Threat Model
  • Assumptions
  • Threats From Weak Cryptography
  • Threats From Improper Use Of Cryptography
• Bug Reporting
• Related

At this time this solution should be considered suitable for research and experimentation, further code and security review is needed before utilization in a production application.

npm install node-webcrypto-ossl

git clone https://github.com/PeculiarVentures/node-webcrypto-ossl
cd node-webcrypto-ossl

npm install

mocha

_{2 ECB support is not defined by the WebCrypto specifications. Use of ECB in a safe way is hard, it was added for the purpose of enabling interoperability with an existing system. We recommend against its use unless needed for interoperability.}

import { Crypto } from "node-webcrypto-ossl";

const crypto = new Crypto();

secp256k1 curve is not defined by the WebCrypto specifications. This module implements K-256 curve for ECDSA algorithm.

K-256 curve examples

To use KeyStorage you should init WebCrypto with directory option. If directory option is missing then keyStorage is null

const { Crypto } = require("node-webcrypto-ossl");

const crypto = new Crypto({
  directory: "key_storage"
})

KeyStorage implements interface of W3 Storage

// generating RSA key
const keys = await crypto.subtle.generateKey({
    name: "RSASSA-PKCS1-v1_5",
    modulusLength: 1024,
    publicExponent: new Uint8Array([1, 0, 1]),
    hash: {
      name: "SHA-1"
    }
  },
    false,
    ["sign", "verify"]
  );

/** 
 * saving private RSA key to KeyStorage
 * creates file ./key_storage/prvRSA-1024
 */
await crypto.keyStorage.setItem(keyPairs.privateKey, "prvRSA-1024");

To get key from KeyStorage

var rsaKey = await webcrypto.keyStorage.getItem("prvRSA-1024");

The threat model is defined in terms of what each possible attacker can achieve.

TODO: ADD ASSUMPTIONS

TODO: ADD THREATS FROM NODE-WEBCRYPTO-OSSL DEFECT

TODO: ADD THREATS FROM WEAK CRYPTOGRAPHY

TODO: ADD THREATS FOR IMPROPER USE OF CRYPTOGRAPHY

Please report bugs either as pull requests or as issues in the issue tracker. node-webcrypto-ossl has a full disclosure vulnerability policy. Please do NOT attempt to report any security vulnerability in this code privately to anybody.

• node-webcrypto-p11
• webcrypto-liner
• WebCrypto Examples
• OpenSSL
• OpenSSL AES GCM encrypt/decrypt