Work in Browser also

[rmhrisk]

Right now the library appears to be node specific, if it were moved to use WebCrypto and took a dependency on a polyfill for WebCrypto on node like mine here https://github.com/PeculiarVentures/node-webcrypto-ossl it should, based on a limited review, work both in browser and on the server side.

[yaronn]

yes, it's a great idea, just need to find the time to do it... I think someone previously replaced the crypto node module in xml-crypto with the forge library which can run in the browser too. What would be the trade off with WebCrypto?

[rmhrisk]

The only downsides can think of might be reduced algorithm support in that Webcrypto defines a limited set of algorithms. That said based on a quick review I don't see anything you would be missing.

[yaronn]

👍 thanks for the quick analysis.

[rmhrisk]

No problem, also on the node side, I would be happy to add whatever algs you need if it was a barrier even if not specified in WebCrypto as long (as they were not insecure). Again though, I dont see anything so this should be all upside.

[rmhrisk]

I should add there are good examples for using WebCrypto here - https://github.com/diafygi/webcrypto-examples/

[yaronn]

Cool! I don't know if this is something @bjrmatos and I can get to soon but we are very open to any PR around this. Based on my understanding the effort is to replace the dependency in the crypto module with WebCrypto.

[rmhrisk]

We are pretty busy with some updates to our own libraries right now but I am interested ins seeing this done (though we don't use this package this time) so if we can free a couple days we will do a PR, but please if you have the time don't wait for us :p

[rmhrisk]

Oh yes, one more reason why this might be interesting is I am releasing a node-webcrypto-p11 module soon, this would give access to hardware security modules and smart cards.

[yaronn]

very cool! smart cards is definitely a required feature.

[rmhrisk]

(to be clear that would only work server side)

[bjrmatos]

sounds good to me! i think this will be something really good to have in the 1.0 release, right now i'm trying to find the time to implement xml c14n so i think we'll wait for your PR :P

[rmhrisk]

I've implemented C14n several times, I feel your pain. May the force be with you ;)

If you have any questions re: C14n or doing the switch to WebCrypto do not hesitate to ping me.

I will put this on our internal list of projects to help out will pull requests and hopefully we can get to doing this in the comming months.

This is a great project, I look forward to it being in a state we can use it.

Good luck!

[bjrmatos]

thnks! definitely more people using xml-crypto is our goal!

[rmhrisk]

We have built on this excellent library have a package that works in both node and the browser here: https://www.npmjs.com/package/xadesjs