Hacker News Reader

Comment by aurorabbit | Hacker News Reader

On the topic of toy web crypto projects, here's mine: https://emojicrypt.com/

It offers scrypt + aes-gcm, encoded into 256 emoji; all the crypto is in https://github.com/aurorabbit/libemojicrypt/blob/master/prot... (I could have went without a subrepo, but in theory it makes non-web integration or alternate interfaces simple.)

It's based off of ricmoo's scrypt.js, pfrazee's base-emoji, and WebCrypto.

Output contains a header (with N/r parameters), salt, IV, and HMAC. Room for a dozen more protocol versions as well.

It's abandoned, looking for a loving home! Work for some new (and some unimplemented) features is laid out here: https://github.com/aurorabbit/emojicrypt.com/issues

View on HN

Nice. Did you measure the performance of scrypt.js? The PBKDF2 implementation in Python and both Chrome/Firefox are similar for me and the Python documentation states something like 3x slower that the OpenSSL implementation [1]. So it sounds pretty usable to strengthen the password while still being usable.

[1] https://docs.python.org/3/library/hashlib.html#hashlib.pbkdf...

Thanks! I didn't, but maybe I should have. I thought the API of scrypt.js would work well and don't think I came across anything better. I also figure scrypt is plainly better than PBKDF2; being designed from ground up for key lengthening and offering memory hardness. I figure bitcoin ASICs might be repurpose-able to attack PBKDF2; though I'm not sure if that's a threat, and I imagine it mostly somewhat applies to scrypt anyway because of litecoin and friends. If I were more worried I would have researched the default parameters more, I think this is 128- vs 256-bit territory.

  :bangbang::penguin::bomb::rabbit2::pig2::black_joker::pray::flashlight::baby_bottle::herb::cookie::arrow_right::loudspeaker::ribbon::ice_cream::fries::link::thought_balloon::1234::rose::point_left::sunglasses::open_hands::game_die::nose::cactus::cake::beetle::musical_keyboard::football::musical_note::point_up_2::ox::dash::no_entry::crown::postal_horn::no_entry::broken_heart::vertical_traffic_light::baby_bottle::ghost::snake::round_pushpin::art::bath::rice::sweat_drops::point_up_2::rocket::postal_horn::gun::traffic_light::tennis::poodle::bath::couple::octopus::maple_leaf::earth_africa::shell::pushpin::rabbit2::sweat_drops::point_right::ghost::hamburger::blue_book::telescope::arrow_right::rooster::purse::beer::flashlight::sob::bride_with_veil::ring::bomb::cupid::pray::bowling:

The password is the FQDN of hn (without the final .)

Reply on news.ycombinator.com