Comments (6)
I generated a sample of 100 private keys each with chrome and firefox with default key size. After that, I parsed the generated keys with openssl.
With both browsers ~33% of the keys were of 1023 bit size, the rest was 1024bit.
Any ideas?
Edit:: I found out that the RSAKey.generate method sometimes generates keys with a modulus which bitlength doesn't match the desired keysize. You can check the bitlength of the generated key with
var crypt = new JSEncrypt();
crypt.getKey().n.bitLength(); // => returns 1023 (bit) or 1024 (bit)
A simple do/while loop could be used to wrap keygen:
var crypt;
do {
crypt = new JSEncrypt({default_key_size: 1024});
crypt.getKey();
} while(crypt.key.n.bitLength() != crypt.default_key_size);
@travist Would you like to add that to the library/wrapper or do you think it is out of the scope of your project?
from jsencrypt.
+1 thanks for your research @phillipp
from jsencrypt.
Well actually that cycle would be a killer for key sizes higher than 1024 so I don't think it would good to integrate into the library. But I can do a bit of researches on the issue and try to break the problem down to its root cause. Thank you for the report anyway, was a hard spot!
from jsencrypt.
I actually use it with 2048 bit keys without problems. It doesn't take too much longer in most cases (the chance that is takes >3.1 times the original runtime is <5%).
I think the underlying problem is that in some cases p
and q
will be chosen to produce an n
that has a most significant bit of 0, so the bitlength is one bit shorter.
This could be avoided if both p
and q
are chosen with the first two most significant bits set. In that case, n
would have exactly the desired bit length. But that would either require patching the upstream RSAGenerate or contacting Tom Wu to change it directly in the lib.
from jsencrypt.
Well actually I did some changes to the underlying library (tracked in my repo zoloft/jsencrypt-core-libs) so it would not be a problem to do some changes as soon as we track all of them. We decided to do this since we didn't receive any reply from Tom Wu. If you look at the code in the develop branch you will see the .gitmodules file containing this:
[submodule "lib/jsbn"]
path = lib/jsbn
url = [email protected]:zoloft/jsencrypt-core-libs.git
unluckily my current work policies do not allow me to work on this project during my current assignment so I cannot work on the next version of the library right now, but if you make a pull request to my repo I would definitely accept it and port to the main repo as soon as I can start working on it again. The next version of JSEncrypt will enable use of WebWorkers, signing and sign verification and generation of SEC keys as well.
As for the timing I guess you have not tried the key generation on a mobile device :)
from jsencrypt.
from jsencrypt.
Related Issues (20)
- Decrypted result has wrong encoding HOT 1
- window is not defined in nuxtjs v3 HOT 8
- Suggest to add judgment when string too long
- Front-end performed RSA signature on the HMAC using SHA256, but the length was incorrect, causing the server to fail to verify it. HOT 1
- CVE-2012-5883
- An error occurred when using jsencrypt in a lower version of Chrome
- encryption returning false HOT 3
- Support node.js ? ReferenceError: window is not defined HOT 6
- Problem after upgrade to latest version from 3.2.1 on verify method
- Why is the result of each encryption different from the same content?
- [REQUEST] remove browser dependency ?
- Can the ciphertext length of JSENCRYPT 3.3.2 be controlled
- nest.js jsencrypt does not work with error `window is not defined`
- Content-Security-Policy blocked jsencryt.min.js file version 3.0.0-rc.2
- Need a fix for CVE-2023-46809 HOT 3
- Problem to decrypt in NodeJs with crypto HOT 1
- How should Java verify your generated signature HOT 1
- How to decrypt Blob、ArrayBuffer ?
- yahoo.js文件中的yui代码存在安全漏洞,是否使用最新版本的代码 HOT 4
- @3.3.2 linux public Rollup failed to resolve import HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from jsencrypt.