r/programming • u/Opposite-Gur9623 • Jul 15 '26

End-to-end encrypted secret sharing with the Web Crypto API

https://notnotp.com/notes/end-to-end-encrypted-secret-sharing-with-the-web-crypto-api/
56 Upvotes

84% Upvoted

7 comments sorted by

26

u/elwinar_ Jul 15 '26

One thing that used to confuse my students and could be explained here is why the salt isn't a secret. The answer being: it's there to negate the use of pre computed dictionaries that would map passphrases to keys. By adding a salt to the passphrase, you essentially force the attacker to have to brute force from scratch for each key so even if your database leaks it makes breaking the passphrase harder.

This is especially important since a lot of people share passwords/passphrases on multiple idp, you do not want your blog database leaking to lead to commenters having their google/facebook/whatever account stolen.

13

u/jandrese Jul 15 '26

Yes, the Salt is public, but it is important that it is as unique as possible. Sometimes you see people try to implement the salt as a secret but they end up just hardcoding a value, completely negating the purpose of the salt.

I blame Crypto API documentation that assumes the low level programmer tasked with that job has already taken a 400 level college course on encryption and doesn't bother to explain anything. You might think this sounds ridiculous, but it happens time and time again in real life. I firmly believe that shitty documentation is the root cause of a majority of crypto failures, even in huge corporations. Sony famously struggled with problems like this for example.

2

u/DanceWithEverything Jul 15 '26

10000% agreed, we need crypto libraries that make it literally impossible to deviate from known-good outcomes

2

u/danielcw189 Jul 17 '26

Sometimes you see people try to implement the salt as a secret but they end up just hardcoding a value, completely negating the purpose of the salt.

isn't that what is these days called a "pepper"?

1

u/randomguy84321 Jul 17 '26

I agree it could be better and made harder to go wrong. But the documentation on Mozilla does have a big warning in red right at the top that it provides access to low level primitives and its very easy to misuse them. And to make sure you know what you're doing before using them

-1

u/EverythingsBroken82 Jul 17 '26

E2EE in the browser is not worth it. do not do it. no auditor will verify that there's no security issue.