This module provides an encrypted writable store for Svelte using the Crypto and SubtleCrypto APIs.
This is mainly a proof-of-concept, and is largely based on the documentation found at Mozilla Developer Network Web Docs:
I'm not a cryptographer. I don't write crypto. They say: don't write crypto, but when you do, learn why you shouldn't have.
On top of it, I'm doing it to learn JavaScript and Svelte. This should be enough for you not to use this module for anything else but what is stated in the introduction: a proof-of-concept, or just fun.
Encryption is done with AES-256-GCM and key derivation with PBKDF2 with SHA-384.
The Salt and Initialization Vector are generated with Crypto.getRandomValues
.
There are only three configurable options:
All these values have very well documented defaults, and you can override any or
all of them passing the opts
parameter. Example:
import { writable } from 'svelte/store';
import { subtleCryptoStore } from 'svelte-subtlecrypto-store';
const backend = writable('');
const store = subtleCryptoStore(window.crypto, backend, 'my super pass', {
iterations: 10000,
saltLength: 16,
ivLength: 64
});
NOTE: these options are very strictly expected to be finite, positive
integer values of type number
. If you supply something like '16'
or 16.1
that value will be dropped and a default used. Use predefined constants,
sanitize your input or check the returned options
member, which contains the
parameters being used.
Source code is written in typescript targetting es2016. By then Crypto and SubtleCrypto APIs were already available in most major browsers.
Crypto and SubtleCrypto APIs are only available in a
Secure Context.
For browsers, this means that the Window
or Worker
have an HTTPS origin, and
if the window belongs to an iframe
, then all its ancestors are also delivered
through HTTPS. There are other cases as well, you can read the linked document
for more information. At runtime, the global and readonly property
isSecureContext
can be used to easily detect the availability of these features, so if it
returns true
then you should have access to these APIs.