computer science

Web Cryptography API

Web Cryptography API is a computer science topic covered in the lgStudy science library. This page brings together a partial reference excerpt, illustrations, worked examples, real-world applications and a short study plan, so you can understand Web Cryptography API rather than just read about it. In short: The Web Cryptography API is the World Wide Web Consortium’s (W3C) recommendation for a low-level interface that would increase the security of web applications by allowing them to perform cryptographic functions without having to access raw keying material. This agnostic API would perform basic cryptographic operations, such as hashing, signature generation and verification and encryption as well as decryption from…

Key takeaways

Web Cryptography API belongs to computer science; place it in that map before memorising details.
Learn the definition first, then one example that makes the definition concrete.
Connect Web Cryptography API to a quantity you can measure, compute or draw — that is where exam questions come from.
Reproduce the core statement of Web Cryptography API from memory before moving on to harder problems.

Reference excerpt

The Web Cryptography API is the World Wide Web Consortium’s (W3C) recommendation for a low-level interface that would increase the security of web applications by allowing them to perform cryptographic functions without having to access raw keying material. This agnostic API would perform basic cryptographic operations, such as hashing, signature generation and verification and encryption as well as decryption from within a web application.

Description On 26 January 2017, the W3C released its recommendation for a Web Cryptography API that could perform basic cryptographic operations in web applications. This agnostic API would utilize JavaScript to perform operations that would increase the security of data exchange within web applications. The API would provide a low-level interface to create and/or manage public keys and private keys for hashing, digital signature generation and verification and encryption and decryption for use with web applications. The Web Cryptography API could be used for a wide range of uses, including:

Providing authentication for users and services Electronic signing of documents or code Protecting the integrity and confidentiality of communication and digital data exchange Because the Web Cryptography API is agnostic in nature, it can be used on any platform. It would provide a common set of interfaces that would permit web applications and progressive web applications to conduct cryptographic functions without the need to access raw keying material. This would be done with the assistance of the SubtleCrypto interface, which defines a group of methods to perform the above cryptographic operations. Additional interfaces within the Web Cryptography API would allow for key generation, key derivation and key import and export.

Proposed functionality The W3C's specification for the Web Cryptography API places focus on the common functionality and features that currently exist between platform-specific and standardized cryptographic APIs versus those that are known to just a few implementations. The group's recommendation for the use of the Web Cryptography API does not dictate that a mandatory set of algorithms must be implemented. This is because of the awareness that cryptographic implementations will vary amongst conforming user agents because of government regulations, local policies, security practices and intellectual property concerns. There are many types of existing web applications that the Web Cryptography API would be well suited for use with.

Multi-factor authentication Today multi-factor authentication is considered one of the most reliable methods for verifying the identity of a user of a web application, such as online banking. Many web applications currently depend on this authentication method to protect both the user and the user agent. With the Web Cryptography API, a web application would have the ability to provide authentication from within itself instead of having to rely on transport-layer authentication to secret keying material to authenticate user access. This process would provide a richer experience for the user. The Web Cryptography API would allow the application to locate suitable client keys that were previously created by the user agent or had been pre-provisioned by the web application. The application would be able to give the user agent the ability to either generate a new key or re-use an existing key in the event the user does not have a key already associated with their account. By binding this process to the Transport Layer Security that the user is authenticating through, the multi-factor authentication process can be additionally strengthened by the derivation of a key that is based on the underlying transport.

Protected document exchange The API can be used to protect sensitive or confidential documents from unauthorized viewing from within a web application, even if they have been previously securely received. The web application would use the Web Cryptography API to encrypt the document with a secret key and then wrap it with public keys that have been associated with users who are authorized to view the document. Upon navigating to the web application, the authorized user would receive the document that had been encrypted and would be instructed to use their private key to begin the unwrapping process that would allow them to decrypt and view the document.

Cloud storage Many businesses and individuals rely on cloud storage. For protection, remote service provide might want their web application to give users the ability to protect their confidential documents before uploading their documents or other data. The Web Cryptography API would allow users to:

Choose to select a private or secret key Derive an encryption key from their key if they wish Encrypt their document/data Upload their encrypted document/data using the service provider's existing APIs

Electronic document signing The ability to electronically sign documents saves time, enhances the security of important documents and can serve as legal proof of a user's acceptance of a document. Many web applications choose to accept electronic signatures instead of requiring written signatures. With the Web Cryptography API, a user would be prompted to choose a key that could be generated or pre-provisioned specifically for the web application. The key could then be used during the signing operation.

Protecting data integrity Web applications often cache data locally, which puts the data at risk for compromise if an offline attack were to occur. The Web Cryptography API permits the web application to use a public key deployed from within itself to verify the integrity of the data cache.

Secure messaging The Web Cryptography API can enhance the security of messaging for use in off-the-record (OTR) and other types of message-signing schemes through the use of key agreement. The message sender and intended recipient would negotiate shared encryption and message authentication code (MAC) keys to encrypt and decrypt messages to prevent unauthorized access.

JSON Object Signing and Encryption (JOSE) The Web Cryptography API can be used by web applications to interact with message formats and structures that are defined under JOSE Working Group. The application can read and import JSON Web Signature (JWK) keys, validate messages that have been protected through electronic signing or MAC keys and decrypt JWE messages.

… excerpt ends here. Continue reading the full article.

Worked examples

Example 1 — a first encounter with Web Cryptography API

Start with the simplest possible case. Write down what Web Cryptography API claims or describes in one sentence, then invent the smallest concrete situation in which that sentence is true. In computer science, the smallest case is usually a single object, a single equation or a single measurement. Check that every symbol or term in your sentence has a meaning in that case.

Example 2 — changing one variable

Take the situation from Example 1 and change exactly one quantity: double it, halve it, or set it to zero. Predict what should happen to Web Cryptography API before you calculate. Comparing your prediction with the result is the fastest way to find out whether you understand the idea or only the words.

Example 3 — an exam-style question

Typical questions about Web Cryptography API ask you to (a) state it precisely, (b) apply it to given data, and (c) explain a limitation. Practise writing all three answers in under five minutes; the third part is what separates a full-mark answer from an average one.

Applications of Web Cryptography API

In research: Web Cryptography API appears in computer science research whenever the underlying quantities have to be modelled precisely. Papers usually cite it as a starting assumption and then explore where it breaks down.
In technology and industry: Engineering practice reuses Web Cryptography API in design rules, simulations and safety margins. Knowing the idea lets you read a specification sheet and understand why the numbers look the way they do.
In the classroom: Web Cryptography API is common in secondary-school and first-year university syllabi. It links to neighbouring topics Cryptography standards, World Wide Web Consortium standards, XML-based standards, so understanding it makes those chapters shorter.
In everyday life: Look for Web Cryptography API outside the textbook — in sport, cooking, traffic, electronics or the sky above you. An example you found yourself is remembered far longer than one you were given.

Ask Teacher Smith questions about this articleOpens your AI tutor with a question about “Web Cryptography API” →

Affiliate

Preply — study more efficiently by working with a personal tutor. 50% off.

How to study Web Cryptography API in 20 minutes

Read the reference excerpt below once, without taking notes.
Close the page and write down what Web Cryptography API means in your own words.
Compare your version with the excerpt and mark what you missed.
Work through the three examples above with pen and paper.
Explain Web Cryptography API out loud to somebody else — or to Teacher Smith in the lgStudy chat.

Frequently asked questions

What is Web Cryptography API in simple terms?

Why does Web Cryptography API matter?

Because it connects several computer science ideas at once: it gives you a definition you can apply, a quantity you can calculate, and a way to check whether a result is plausible.

How should I study Web Cryptography API?

Read the excerpt, restate it from memory, then work through the examples and applications listed on this page. The five-step study plan above takes about twenty minutes.

What does this page cover?

It gives you a compact reference excerpt plus original lgStudy explanations, examples, applications and study material on Web Cryptography API.