I do understand that the security of web cryptography API comes from how it encapsulates the key object natively and disallows its access from JavaScript context unless exported.

However I would like to go further, this security model is only secure if the hacker cannot reverse engineer the browser binary itself to somehow figure out the key. I've been looking for a source on how the technology is actually implemented by browsers internally.

Is there a guarantee that a malicious actor cannot break into a browser and extract out keys "natively" instead? Are the keys stored encrypted internally somehow?

  • 3
    $\begingroup$ You're talking about a DRM scenario, right? You're trying to protect your content from the user that owns the hardware that the browser is running on and at the same time wants to consume your content through the browser. If that's the case Web Crypto API doesn't provide any guarantees for that, because it's easy to fork Chromium and Firefox. There is no need for reverse engineering. What you want is Encrypted Media Extensions. Those must be closed source and could still be reverse engineered. $\endgroup$ – Artjom B. Dec 27 '17 at 21:06

The Web Crypto API isn't intended to stop users from getting their own keys, or guaranteeing that to web pages. The Web Crypto API allows web pages to create and use private keys that the web page (and future versions of the web page) can not access; the API is about protecting web pages' keys from themselves.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.