Find alternative to node-webcrypto-ossl

[dignifiedquire]

Sadly we will have to let go of node-webcrypto-ossl as it is blocking users from using it in electron.

Details can be found here:

• Build for electron not working PeculiarVentures/node-webcrypto-ossl#77
• 0.23.0 release breaks modules using openssl electron/electron#1410 (comment)

We currently use

• ECDH: https://github.com/libp2p/js-libp2p-crypto/blob/master/src/crypto/ecdh.js
• RSASSA-PKCS1-v1_5: https://github.com/libp2p/js-libp2p-crypto/blob/master/src/crypto/rsa.js

Of which

• ECDH is available in Node.js core: https://nodejs.org/docs/latest/api/crypto.html#crypto_class_ecdh but we have to check if this provides everything we need.
• RSA support is not complete in Node.js core as far as I understand, so we will need a different module for this.

[dignifiedquire]

cc @diasdavid :(

[dignifiedquire]

After some more investigation it seems that node core is able to do encryption and decryption using RSA keys, but generate them.

[daviddias]

@dignifiedquire what about https://www.npmjs.com/package/keypair ? I was using it before node-forge

[dignifiedquire]

Pure js was the reason things were so slow, this needs to do better than that.

[daviddias]

Generating keys is a one-time operation. Breaking users ability to use it in electron and Windows is more prejudicial.

[haadcode]

Can we somehow include OpenSSL into the build process of node-webcrypto-ossl?

[dignifiedquire]

Breaking users ability to use it in electron and Windows is more prejudicial.

This is not correct, there are only two specific cases we actually break

• Any OS with a non working node-gyp setup.
• Electron server process.

The electron renderer process will work fine given that it is running inside a browser and has webcrypto available. The detection here might fail if you don't use a bundler to generate you renderer files, but this is easily fixable.

Those two specific cases do not warrant making things significantly slower for everyone in my opinion.

Can we somehow include OpenSSL into the build process of node-webcrypto-ossl?

You really don't want that, as that would mean recompiling openssl on every install

--

Moving forward I think the following is our best option

• Migrate everything to node core that is possible
• For RSA key generation use webcrypto-ossl as an optional dependency and fallback to a pure JS version in node.js
• Write a proposal and make a PR for node core to add RSA key generation. It's 2016, missing RSA key generation is still baffling for me..

[haadcode]

I'm trying to build it manually, adding the absolute path to openssl headers in bindings.gyp:

"include_dirs": [
	"/Users/haad/code/node/deps/openssl/openssl/include",
	"<!(node -e \"require('nan')\")"
],

...and that compiles it fine with electron-rebuild.

So what I take from this is that we could include openssl source in the module and make it build. Which is funny because I remember using node-webcrypto-ossl module in August-ish, had same problems and remember that I got it all working nicely. So I wonder what changed.

Looking into it more...

[haadcode]

Or we provide pre-built binaries for the Electron use case (limited to latest version)?

[dignifiedquire]

Or we provide pre-built binaries for the Electron use case (limited to latest version)?

Not sure if that's possible, but yes if we can provide prebuilt versions for all major platform combinations that you would also be a viable option forward, ref #31

[dignifiedquire]

One other option would be to benchmark try to integrate https://github.com/vibornoff/asmcrypto.js

[dignifiedquire]

Quick benchmark (Node 7.2)

Current (node-webcrypto-ossl)

generateKeyPair 1024bits x 36.15 ops/sec ±10.99% (38 runs sampled)
generateKeyPair 2048bits x 8.40 ops/sec ±14.55% (25 runs sampled)
generateKeyPair 4096bits x 1.01 ops/sec ±40.31% (10 runs sampled)

asmcrypto.js

generateKeyPair 1024bits asmcrypto.js x 2.79 ops/sec ±23.42% (12 runs sampled)
generateKeyPair 2048bits asmcrypto.js x 0.36 ops/sec ±67.37% (6 runs sampled)
generateKeyPair 4096bits asmcrypto.js x 0.07 ops/sec ±55.12% (5 runs sampled)

keypair

generateKeyPair 1024bits - keypair x 2.65 ops/sec ±32.29% (12 runs sampled)
generateKeyPair 2048bits - keypair x 0.21 ops/sec ±71.87% (5 runs sampled)
generateKeyPair 4096bits - keypair x 0.02 ops/sec ±61.46% (5 runs sampled)

[haadcode]

that is a considerable difference :/