What is WebThemis
WebThemis enables web app developers to build browser applications with strong cryptographic services, provided by Themis cryptographic library.
Currently, WebThemis works in Google Chrome as PNaCl module; it can be loaded during a regular web session, or used as a library within Chrome App.
WebThemis provides main Themis cryptographic services:
Secure Cell: a multi-mode cryptographic container, suitable for storing anything from encrypted files to database records and format-preserved strings. Secure Cell is built around AES in GCM (Token and Seal modes) and CTR (Context imprint mode).
Secure Message: a simple encrypted messaging solution for widest scope of applications. ECC + ECDSA / RSA + PSS + PKCS#8.
Secure Session: session-oriented, forward secrecy messaging solution with better security guarantees, but more demanding infrastructure. ECDH key agreement, ECC & AES encryption.
Read Themis documentation and check out our github repo to learn more.
In case you're not familiar with Themis feature set, there are a few things you might want to read:
Current repository README.MD
NOTE: WebThemis is a stable, yet considered experimental feature. Most of the checks run smoothly now, yet we're still performing a lot of testing.
Using WebThemis
Using WebThemis involves 3 steps:
Implementing security logic in C++
Building PNaCl module
Implementing web page with JS, which exchanges messages with the PNaCl module
Refer to official docs (rather laconic) for more details.
Directly calling cryptographic functions (even as high-level as they are in Themis) from JS is not safe: there is the wide spectrum of possible ways to intercept the calls, reload the calling code and bypass cryptography. So, the best reliable we can use is having some minor part of process logic within the PNaCl module too: this way, if the module gets bypassed, the normal flow breaks in a functional way.
In /examples/ folder we show two simple examples of having a HTML page, loading the PNaCl module with both WebThemis and a simple API handler for JS code.
We haven't provided an example for Secure Session, and did that for a reason: by bypassing callbacks / transport hooks attacker can interfere with key agreement phase of the protocol and lower, if not neglect, security guarantees.
The right way to use Secure Session is to control transport invocation directly from a PNaCl app. We've created an example web app illustrating this approach, details on which we will publish soon.
Want to know more?
What's wrong with web crypto? or why did we pursue to build WebThemis at all.
A WebThemis sample project: Building end-to-end secure webchat w/ Webthemis
2018 UPD: This article is still technically valid, yet Themis has significantly evolved since this article saw the light of the day and we’ll be moving to WebAssembly soon.
If you're looking for new ideas on building cryptography security, this is the right place. If you're looking to implement security, apply for our Customer Success Program, we can help. If you're looking for a ready-made solution, consider looking up more articles about web cryptography to understand the matters deeper. Also, consider checking out other Cossack Labs’ products like Themis, Acra, and Hermes.
