Dirk Holtwick holtwick

Cryptographic Best Practices

Putting cryptographic primitives together is a lot like putting a jigsaw puzzle together, where all the pieces are cut exactly the same way, but there is only one correct solution. Thankfully, there are some projects out there that are working hard to make sure developers are getting it right.

The following advice comes from years of research from leading security researchers, developers, and cryptographers. This Gist was [forked from Thomas Ptacek's Gist][1] to be more readable. Additions have been added from

OUTDATED

JavaScriptCore is a built-in iOS library that enables you to use JavaScript in apps alongside Objective-C and Swift. It lets developers read JavaScript from a string, execute it from Objective-C or Swift, and share data structures and functions across languages. We JavaScriptCore to share code between Web and iOS.

This demonstrates the implementation of full text search for documents in Indexed DB.

Word-breaking and stemming is used to create a list of terms for each document.
Document records are annotated with the list of terms when added to the database.
A multi-entry index on the list of terms is populated.
A query is similarly processed into a list of terms.
A join over the terms is implemented using multiple cursors on the index.

The necessity of annotating records with the word list to populate the index is a limitation of the current Indexed DB API. A feature request to support custom

Async/Await for Swift

Proposal: SE-XXXX
Authors: Chris Lattner, Joe Groff

Introduction

Modern Cocoa development involves a lot of asynchronous programming using closures and completion handlers, but these APIs are hard to use. This gets particularly problematic when many asynchronous operations are used, error handling is required, or control flow between asynchronous calls gets complicated. This proposal describes a language extension to make this a lot more natural and less error prone.

This paper introduces a first class Coroutine model to Swift. Functions can opt into to being async, allowing the programmer to compose complex logic involving asynchronous operations, leaving the compiler in charge of producing the necessary closures and state machines to implement that logic.

	const id = '__JUNK__';
	// Public key need to be in PKCS8 format
	// ssh-keygen -e -m PKCS8 -f id_rsa.pub > id_rsa.pkcs8
	const publicKey = fs.readFileSync(path.join(__dirname, 'id_rsa.pkcs8'), { encoding : 'utf8' });
	const privateKey = fs.readFileSync(path.join(__dirname, 'id_rsa'), { encoding : 'utf8' });

	// Sign
	const signer = crypto.createSign('RSA-SHA512');
	signer.update(id);
	const signature = signer.sign(privateKey, 'hex');

	/**
	* Encrypts plaintext using AES-GCM with supplied password, for decryption with aesGcmDecrypt().
	* (c) Chris Veness MIT Licence
	*
	* @param {String} plaintext - Plaintext to be encrypted.
	* @param {String} password - Password to use to encrypt plaintext.
	* @returns {String} Encrypted ciphertext.
	*
	* @example
	* const ciphertext = await aesGcmEncrypt('my secret text', 'pw');

	// http://stackoverflow.com/a/40089462

	extension Data {
	func hexEncodedString() -> String {
	return map { String(format: "%02hhx", $0) }.joined()
	}
	}

	// Spec http://www.ecma-international.org/ecma-262/6.0/#sec-json.stringify
	const replacer = (key, value) =>
	value instanceof Object && !(value instanceof Array) ?
	Object.keys(value)
	.sort()
	.reduce((sorted, key) => {
	sorted[key] = value[key];
	return sorted
	}, {}) :
	value;

	package main

	import (
	"crypto/aes"
	"crypto/cipher"
	"crypto/rand"
	"crypto/sha256"
	"encoding/hex"
	"fmt"
	"strings"

	import produce from 'immer';
	import {createStore} from 'redux';

	const handleActions = (actionsMap, defaultState) => (
	state = defaultState,
	{type, payload}
	) =>
	produce(state, draft => {
	const action = actionsMap[type];
	action && action(draft, payload);