Which encryption algorithm for FP and JavaScript? lazarus / 38-Networking and Web Programming ---------------------------------------------------------------------- Jorg3000 · 2023-06-12 05:35 Hi! I want to be able to decrypt content encrypted with JavaScript (Chrome/Firefox) in my FreePascal program - and vice versa. So far I haven't tried any encryption at all, neither in FP nor in JS. Who can recommend me a chiper that works natively in Chrome/Firefox (Crypto API) and for which there is a data-compatible equivalent for FreePascal? Thanks in advance! Jörg ---------------------------------------------------------------------- Warfley · 2023-06-12 08:53 The brwosers Crypto API supports the following algorithms: https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto/encrypt QuoteThe Web Crypto API provides four algorithms that support the encrypt() and decrypt() operations. One of these algorithms — RSA-OAEP — is a public-key cryptosystem. The other three encryption algorithms here are all symmetric algorithms, and they're all based on the same underlying cipher, AES (Advanced Encryption Standard). The difference between them is the mode. The Web Crypto API supports three different AES modes:     CTR (Counter Mode)     CBC (Cipher Block Chaining)     GCM (Galois/Counter Mode) So either asymetric RSA with OAEP padding, or symetric with AES in CTR, CBC, or GCM mode ---------------------------------------------------------------------- Jorg3000 · 2023-06-13 03:18 Thanks! Which package can someone recommend for FreePascal? Has anyone done this before (in JS and FP) and has sample code at hand? ---------------------------------------------------------------------- cdbc · 2023-06-13 04:41 Hi You could try: https://github.com/Xor-el That's a crypto library made by Ugochukwu Mmaduekwe. It's written in pascal and considered State Of The Art. Regards Benny ---------------------------------------------------------------------- jcmontherock · 2023-06-13 09:36 DCPCrypt... ---------------------------------------------------------------------- Warfley · 2023-06-13 10:14 I would be careful with Pascal implementations like CryptoLib4Pascal or DCPCrypt, because have quite a small user base and are therefore not so well tested. This may be enough for some applications, but I wouldn't trust any sensible data with this. Just as an example, since OpenSSL 3.0.0, which was released in the end of 2021, there was a bug in the AES implementation that was found in the end of last year, so it lay dorment for over a year. OpenSSL is used by millions of developers, and vetted and tested by hundreds of security researchers. Just looking at the GitHub, it has nearly 800 contributors to it's code base. And still bugs are found that have beend there for months, years or sometimes (e.g. heartbleed) decades. Projects like CryptoLib4Pascal cannot provide the same level of testing as OpenSSL can, it is developed by one person and used maybe by a few hundred or thousand developers. DCPCrypt hasn't received any updates for over 10 years now. This is why I wouldn't consider any of those state of the art. While there is also the "advantage" that because of that little usage, there are not many people trying to break it and while you can see all the vulnerabilities of a specific OpenSSL version in the CVE database of MITRE, that anyone could exploit, it requires manual analysis to find some vulnerabilities. Meaning, bizzarly enough, through it's little testing it is more robust against the extremely simple attacks, where you just copy existing attacks from the past for outdated versions, but for more sophisticated attackers, who are willing to put time into analyzing the code, this is an easy attack vector. So if you want state of the art security, you should use a thouroughly vetted crypto library. The easiest solution there is the existing OpenSSL Wrapper that is provided with your FPC installation. The downside is that all the documentation, and most examples online are C code, but this is usually quite simple to translate.