Woobie

Wrap information in a blanket of privacy and security. Woobie is a javascript protocol for securing communication end-to-end.

In Progress

Do not use this for anything serious!

I'm working on this in my spare time, so there's still lots to do and this is by no means stable, let alone secure (yet).

So far, I've got two main functions (appropriately named "encrypt" and "decrypt"), which implement encryption using AES-256-CBC + HMAC-SHA-512, or alternatively using AES-256-GCM, along with functions for use in a Diffie Hellman key exchange using curve25519 for calculating an elliptic curve from a randomly generated byte array. There are also some helper functions for converting byte arrays to base64 or hex (and vice versa) as well as compressing strings with zlib.

• AES and HMAC are implemented using either crypto on Node.js or Webcrypto when in the browser.
• Curve25519 is implemented using tweetnacl.
• Base64 conversions are done using base64-js.
• Zlib (de)compression is done using pako.

Why AES and not something newer like salsa/chacha20 with poly1305 auth?

Well, AES-256 and SHA-512 (as well as curve25519) are pretty well tested and validated to be pretty darned secure, plus they already have some hardware optimizations which can be taken advantage of when they are available which will make apps more responsive (but they're reasonably fast as pure software too).

I do want to also include Tweetnacl's salsa20poly1305 implementation as an option, but I'll be coming back to that later after I've got the basics covered.

WTF is a Woobie?

In the 1983 Micheal Keaton movie "Mr. Mom", the youngest child affectionately called his security blanket a "woobie". This stuck in my head when trying to think up a name that encapsulated the idea of "wrap a message in security" as a description of an end-to-end encryption protocol. Also, nobody else was using it.

Don't let your messages out on the open net without their woobie ;)

TODO

Lots.

I'd like to implement an abstraction layer for making a "session" or "box" which could encapsulate the logic for exchanging keys and keeping track of them along with packing up a message (encrypting it) and sending it to a recipient who could then open the message (decrypt it). Ideally I'd like to simply execute packBox(plainText) and openBox(cipherText) at the application layer and have this module handle all the details required for that. Not sure what that looks like yet, but would like to handle crypto protocol logic here, and keep it all out of the application that's using this.

Once basic crypto is working, I'd like to wrap it all in an extra layer of post-quantum crypto using lattice algorithms to further bolster the cipher-text against future (or maybe existing!) quantum computers.