Is JavaScript encryption still secure ?

[B0b-A]

JavaScrypt is an encryption program [ 256AES ?] released in 2005 ...

http://www.fourmilab.ch/javascrypt/javascrypt.html

Is this still a secure method of encryption ? ,
an example of an encrypted messages is below, [ the key is a 64 character hexadecimal number ]

##### Encrypted: decrypt with www.fourmilab.ch/javascrypt/javascrypt.html
?HX?98173c79973dccf051f1820b34726b6d9309124671568aa911bdef6e4b56
541e115a49f22a113e5eea288546f761e8350aead00d3efbe1ff45a37d011f25
5c3108214f785801a833bac2eb456af324c957741c2d99180ac5e1d1e1febaf1
bded?H
##### End encrypted message

A bruteforce crack allegedly would take trillions of centuries ... https://www.grc.com/haystack.htm

 

[jim mcnamara]

The short, and probably not what you want, answer: Yes but it depends.

Important points:
1. Security is NOT encryption. Encryption is a small part of overall security. Security is very multi-faceted, and depends on lots of layers to be effective.
2. Do not confuse time to decrypt with anything more than a means to scare off the script kiddie attacks. Time to decrypt simply forces some wannabe hacker to go on to another site, for example.
3. If you expect encryption alone to deter a well-funded government agency from most countries, think again.

Plus:
The site you link to about bruteforce attack, explains the other depends. If you have an 8 byte, diverse character-space password the straight bruteforce attack duration is determined by the number of characters. 16 bytes takes longer to bruteforce. The idea behind the website - make your password secure enough so the bad guys will go away, and choose some very easily hackable system.Before you entrust your life's savings to some encryption based security scheme go to Bruce Schnier's site. He has a bunch of articles.

http://www.schneier.com/about.html

IT Management, usually non-technical folks, ask questions like this all the time. So you asked a good question, keep working on it.

 

[B0b-A]

3. If you expect encryption alone to deter a well-funded government agency from most countries, think again.

Plus:
The site you link to about bruteforce attack, explains the other depends. If you have an 8 byte, diverse character-space password the straight bruteforce attack duration is determined by the number of characters.

I was looking for a method to store encrypted passwords in away that could be decrypted on any computer OS, (Windows/Linux/Mac), and JavaScrypt seemed to offer that, provided it had an internet browser with JavaScript. The encryption need only be sufficient enough to prevent criminal element from helping themselves to my bank account, rather than defeat the FBI.

Online banking uses 256bit encryption , so on the face of it JavaScrypt (AES256) appears to be as least as strong for the same key length.

BTW the key for the encrypted message in the first post is the hexadecimal number (not “text”) below … 1BF5427B1DEB40557B05276D27CC801DD9C500D87441C8B7DF159575D2D851D0

 

[harborsparrow]

Basic misunderstand is going on here. "Encrypted passwords" are never unencrypted. They are encrypted with one-way encryption the first time the password is entered, then the encrypted form is stored. This is so that people cannot just break into the password database and steal your password. (It's actually more complex than that, as passwords get "salted" as well as encrypted--Google it).

To use an encrypted password, you need to have the same one-way encryption algorithm, encrypt the received password (which should have come to you via an already-secure transmission medium), and then retrieve the encrypted STORED password and compared the just-encrypted recently-entered password.

I have no idea whether JavaScrypt software does a good job of this or not, but was concerned about the phrase "in a way that could be decrypted" because it indicates a basic misunderstanding of how encrypted passwords need to be handled.

 

[jhae2.718]

If you're storing passwords, use something like bcrypt.

Using JavaScript (the language) for encryption is generally frowned upon in the security community (though there is some argument on this point). Browsers are generally insecure and it's too easy to modify code that is run on the client.

What exactly do you hope to accomplish, and what is your threat model?