Ability to use browser's native implementation
See original GitHub issueWith the Web Cryptography API becoming a W3C Recommendation as of 26th of January of 2017, we could safely implement pbkdf2
natively for some browsers (i.e. Chrome and Firefox). I know we are browserifying crypto
here, but maybe we could fallback to the native methods if implemented.
Would you be interested in having such a fallback in this repo? It’s pretty popular and other people seem to use it a lot in the browser. Here’s how I implemented it for github.com/jjperezaguinaga/deniable.website.
const pbkdf2Native = (password, salt, iterations, digest, mode, keylen) =>
(window.crypto.subtle||window.crypto.webkitSubtle).importKey('raw', password, {name: 'PBKDF2'}, false, ['deriveKey'])
.then(baseKey => (window.crypto.subtle||window.crypto.webkitSubtle).deriveKey({name: 'PBKDF2', salt, iterations, hash: digest, baseKey, {'name': mode, 'length': keylen*8}, true, ['encrypt', 'decrypt']))
.then(key => (window.crypto.subtle||window.crypto.webkitSubtle).exportKey('raw', key))
I can make a PR to detect window and leverage on it based on the options given, since it seems the API has some limitations (e.g. keylen for mode has to be either 128 or 256 bits, see https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto/deriveKey). You can see how lesspass is using it alongside this repository for a reference of what we could do.
Issue Analytics
- State:
- Created 6 years ago
- Reactions:1
- Comments:6 (4 by maintainers)
@fanatid if we documented the difference that
pkbdf2
async could be higher performance… I think people would be OK with that.this is done