paint-brush
Web Crypto API: A Low-Level Interface for Internet Securityby@mozilla
289 reads

Web Crypto API: A Low-Level Interface for Internet Security

by Mozilla ContributorsApril 27th, 2020
Read on Terminal Reader
Read this story w/o Javascript
tldt arrow

Too Long; Didn't Read

The Web Crypto API is an interface allowing a script to use cryptographic primitives in order to build systems using cryptography. It's very easy to misuse these primitives, and the pitfalls involved can be subtle. Some browsers implemented an interface called 'Crypto' without having it well defined or being cryptographically sound. The API methods are now available on a new interface:SubtleCrypto.subtlecrypto.property. The new interface gives access to an object implementing it. The API is now available to browsers implementing the Web Crypto. API.

Company Mentioned

Mention Thumbnail
featured image - Web Crypto API: A Low-Level Interface for Internet Security
Mozilla Contributors HackerNoon profile picture

The Web Crypto API is an interface allowing a script to use cryptographic primitives in order to build systems using cryptography.

The Web Crypto API is an interface allowing a script to use cryptographic primitives in order to build systems using cryptography.

Warning: The Web Crypto API provides a number of low-level cryptographic primitives. It's very easy to misuse them, and the pitfalls involved can be very subtle.
Even assuming you use the basic cryptographic functions correctly, secure key management and overall security system design are extremely hard to get right, and are generally the domain of specialist security experts.
Errors in security system design and implementation can make the security of the system completely ineffective.
If you're not sure you know what you are doing, you probably shouldn't be using this API.

Interfaces

Some browsers implemented an interface called

Crypto
without having it well defined or being cryptographically sound. In order to avoid confusion, methods and properties of this interface have been removed from browsers implementing the Web Crypto API, and all Web Crypto API methods are available on a new interface:
SubtleCrypto
. The
Crypto.subtle
property gives access to an object implementing it.

Specifications

Browser compatibility

Crypto

Credits