Скачать или смотреть sec4dev 2020 - End-to-end File Encryption in the Web Browser: A Case Study

Speaker: Thomas Konrad


Ever thought of encrypting uploaded files in the web browser before they hit the server? Most web browsers nowadays offer encryption modules via the Web Crypto API for the encryption itself, but we’ll soon see that this isn’t enough. What about the correct cipher modes? How can we ensure confidentiality, integrity and authenticity? What about big files and limited memory availability. In this talk, we’ll cover the following topics:
Issues you’ll face when implementing end-to-end file encryption in the
browser
The crypto basics behind file and metadata encryption
The Web Crypto API
The FileReader API for chunked uploads
The ReadableStream API for chunked downloads
Service Workers and how they’ll help us
Browser compatibility of the mentioned APIs
What we can do to support older browsers
The hardest part: key distribution