WebThemis: Stronger Cryptography for Modern Web

What is WebThemis

WebThemis enables web app developers to build browser applications with strong cryptographic services, provided by Themis cryptographic library.

Currently, WebThemis works in Google Chrome as PNaCl module; it can be loaded during regular web session, or used as a library within Chrome App.

WebThemis provides main Themis cryptographic services:

  • Secure Cell: a multi-mode cryptographic container, suitable for storing anything from encrypted files to database records and format-preserved strings. Secure Cell is built around AES in GCM (Token and Seal modes) and CTR (Context imprint mode).
  • Secure Message: a simple encrypted messaging solution for widest scope of applications. ECC + ECDSA / RSA + PSS + PKCS#8.
  • Secure Session: session-oriented, forward secrecy messaging solution with better security guarantees, but more demanding infrastructure. ECDH key agreement, ECC & AES encryption.

Read Themis documentation and check out our github repo to learn more.

In case you're not familiar with Themis feature set, there are a few things you might want to read:

NOTE: WebThemis is a stable, yet considered experimental feature. Most of the checks run smoothly now, yet we're still performing a lot of testing.

Using WebThemis

Using WebThemis involves 3 steps:

  1. Implementing security logic in C++
  2. Building PNaCl module
  3. Implementing web page with JS, which exchanges messages with the PNaCl module

Refer to official docs (rather laconic) for more details.

Directly calling cryptographic functions (even as high-level as they are in Themis) from JS is not safe: there is the wide spectrum of possible ways to intercept the calls, reload the calling code and bypass cryptography. So, the best reliable we can use is having some minor part of process logic within the PNaCl module too: this way, if the module gets bypassed, the normal flow breaks in a functional way.

In /examples/ folder we show two simple examples of having a HTML page, loading the PNaCl module with both WebThemis and a simple API handler for JS code.

We haven't provided an example for Secure Session, and did that for a reason: by bypassing callbacks / transport hooks attacker can interfere with key agreement phase of the protocol and lower, if not neglect, security guarantees.

The right way to use Secure Session is to control transport invocation directly from a PNaCl app. We've created an example web app illustrating this approach, details on which we will publish soon.

Want to know more?

Copyright © 2014-2017 Cossack Labs Limited
Cossack Labs is a privately-held British company with a team of data security experts based in Kyiv, Ukraine.