What level of encryption was chosen for TW's SJCL?

[Justin_H]

Just out of curiousity, I was wondering if, when SJCL was implemented into tiddlywiki, was AES 256 chosen and adopted, or a different amount? It appears to match the provided minified code, however I wasn’t sure what level that was either

And, not completely related but, does the encrypt individual tiddlers plugin piggyback off of the normal encrypt js in tiddlywiki?

Unfortunately I can’t read JS well enough to find the answers myself, so any insight from someone who knows would be greatly appreciated.

[arunnbabu81]

Query: How secure is the inbuilt encryption option in TW?

I did a little digging, TiddlyWiki uses the SJSC Library and does not pass any configuration (as far as I could tell). Therefor it uses the SJSC defaults. Unfortunatly, the SJSC documentation does not disclose what those defaults are. So I took it on myself to run a sample through the Demo using just default values and the result was: { "iv": "+Idg4aGgkQ7gc/FTSzpAOQ==", "v": 1, "iter": 1000, "ks": 128, "ts": 64, "mode": "ccm", "adata": "", "cipher": "aes", "salt": "AEqd6WKMDH…

This discussion might be of help to you

[jeremyruston]

SJCL was integrated into TiddlyWiki 5 in September 2012 in this commit. I chose SJCL because it was the most widely used and trusted open source JS cryptographic library at the time. Nowadays one might be tempted to use the new browser crypto APIs but it’s actually convenient for TW to have the same code available on the server and in the browser.

[Justin_H]

@arunnbabu81

This discussion might be of help to you

It did indeed! The answer is aes 128 in ccm mode!

@sukima

This looks like the default is: AES 128 in CCM mode. I’d say that is pretty good! IIRC this is the same default for Mac Encrypted Disk Images.

Now if you wanted I don’t think it would be too difficult to modify the TiddlyWiki source to increase that to 256 but even then I don’t think it would matter too much.

That being said, I’m going to look into what sukima mentioned and try to change it to aes 256.

@jeremyruston

SJCL was integrated into TiddlyWiki 5 in September 2012 in this commit. I chose SJCL because it was the most widely used and trusted open source JS cryptographic library at the time. Nowadays one might be tempted to use the new browser crypto APIs but it’s actually convenient for TW to have the same code available on the server and in the browser.

Honestly, I think the right choice was made in choosing SJCL.