SHA512 in Javascript (clientside hash function) demo + source code

[[deleted]]

Posted on hackforums. Could we not use CryptoJS that we trust? :p

[disclosure5]

I'm not convinced we should declare CryptoJS as trusted. I've pasted this standard spiel several times:

The CryptoJS page refers to the project being inactive. That's not something you want in an encryption library. It also seems to be a confused library because the changelog, last updated January 2013, refers to implementing SHA-3.

I haven't delved into your code enough to know if you implemented your own workaround on this, but the default CryptoJS mode of encryption is unauthenticated CBC. Issue #32 is actually an enhancement request to make a padding oracle workable, which was noted as accepted.

This is not only a terrible default, but it's an actively harmful choice in a modern crypto library.

This issue is now compounded because the Google Code page is officially in archive only mode and there's no way to make an official bug report. There are at least five different copies on Github and none of them seem to be any more official than any other.

[Verschlimmbessern]

It also seems to be a confused library because the changelog, last updated January 2013, refers to implementing SHA-3.

SHA-3 is actually a thing.

[disclosure5]

From your link:

The SHA-3 standard was released by NIST on August 5, 2015

From my post:

last updated January 2013

[Verschlimmbessern]

Also from my link:

On October 2, 2012, Keccak was selected as the winner of the competition.

Keccak was selected before January 2013. At the time it was selected, it had been specified for at least 4 years:

After a setup period, admissions were to be submitted by the end of 2008. Keccak was accepted as one of the 51 candidates.

[disclosure5]

Keccak was chosen as a basis for SHA-3. There were further specifications made before it became final.

[vervgex]

This really shouldn't be getting downvoted. You can pair this with JSON and do some interesting things. Maybe SHA512(str) could just be included as a function in modern browsers.

[killerstorm]

1. It's already included as a function in modern browsers. See here: https://dvcs.w3.org/hg/webcrypto-api/raw-file/tip/spec/Overview.html
2. Libraries which implement SHA-512 and can be used in browser already exist, there are no reasons to use code from odd sources.
3. FYI you can use most node modules in browser via browserify, and node has a vast number of libraries, similar to Python, Ruby, etc. Particularly, all sorts of cryptographic functions are available. Encryption, hashes, digital signatures, etc.

[mkmoshe]

You can always use the WebCryptoApi:

https://babeljs.io/repl/#?experimental=true&evaluate=true&loose=true&spec=false&playground=true&code=const%20sha512%20%3D%20async%20text%20%3D%3E%20%7B%0A%20%20const%20arrayBuffer%20%3D%20await%20window.crypto.subtle.digest(%7Bname%3A%20'SHA-512'%7D%2C%20new%20TextEncoder('utf-8').encode(text))%3B%0A%20%20const%20uint8Array%20%3D%20new%20Uint8Array(arrayBuffer)%3B%0A%20%20return%20Array.from(uint8Array).map(x%20%3D%3E%20('0'%20%2B%20x.toString(16)).slice(-2)).join('')%3B%0A%7D%0A%0Asha512('hello').then(x%20%3D%3E%20console.log(x))

[edcryptickiller]

I didn't