Where does the WebCrypto API store keys?

Question

I am using the webcrypto API with some success to encrypt messages between server and client (lets assume I need to do this manually).

My problem is that I need to check if a keypair for the user and server already exists instead of generating a new keypair all the time. Is there a way to check if it exists and retrieve it for decryption of server messages?

To clarify, my privateKey is on the browser and publicKey is sent to server.

I have a nodejs server and plain JS front end.

Thanks in advance.

Claw

Consider this answer, which was found by googling your title. – Fireback

Thanks @JamesKPolk I read that Q but only the first reply... my bad. – Claw

Answer 1

CryptoKeys are not persistent by default. You need to store the keys in the IndexedDB to make them available to the next browser execution.

IndexedDB is a secure storage, keys can be stored, recovered and used without exposing the key material

See https://www.w3.org/TR/WebCryptoAPI/#concepts-key-storage

5.2. Key Storage

This specification does not explicitly provide any new storage mechanisms for CryptoKey objects. Instead, by allowing the CryptoKey to be used with the structured clone algorithm, any existing or future web storage mechanisms that support storing structured clonable objects can be used to store CryptoKey objects.

In practice, it is expected that most authors will make use of the Indexed Database API, which allows associative storage of key/value pairs, where the key is some string identifier meaningful to the application, and the value is a CryptoKey object. This allows the storage and retrieval of key material, without ever exposing that key material to the application or the JavaScript environment

Here you have a full example https://blog.engelke.com/2014/09/19/saving-cryptographic-keys-in-the-browser/

Galton

Many resources say that IndexedDB is saved as clear text on the hard disk. How is this considered safe? – Casaleggio

Answer 2

SOLVED:

You can use IndexedDB for storing CryptoKey objects.

I tried plain old local storage and it does not work.

For more info, see:

• https://pomcor.com/2017/06/02/keys-in-browser/
• https://www.w3.org/TR/WebCryptoAPI/
• https://developer.mozilla.org/en-US/docs/Web/API/Web_Crypto_API
• https://www.w3.org/TR/IndexedDB/
• https://www.boxcryptor.com/en/blog/post/building-an-app-with-webcrypto-in-2016/
• https://gist.github.com/saulshanabrook/b74984677bccd08b028b30d9968623f5
• https://blog.engelke.com/2014/09/19/saving-cryptographic-keys-in-the-browser/

Claw

A little addition: localStorage does not work because it can only store strings. CryptoKeys are not strings, so they cannot be stored in localStorage. – Kreager

Answer 3

You should Use indexed DB to store Keys on the client side. The benefit of using Indexed DB is that you will be able to store keys as they are (mostly in CryptoKey form) and use them after retrieving from Indexed DB.

You won't have to export keys and then transform in some way like base64 encode or JSON encode as in case of other storage options like LocalStorage.

To make indexedDB usage easier, there is a promise based library available which is very often used by the tutorials and posts that cover indexed DB usage

Barnum