lotobo/crypto-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 2 Wiki Activity

Release Crypto Tools 0.2.0
Verify / verify (push) Canceled after 0s
Details

Browse Source
This commit is contained in:
zemion
2026-09-02 10:40:23 +02:00
parent 4b75f819e2
commit 82bb01b13f
37 changed files with 3673 additions and 140 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+11 -5
View File
@@ -4,15 +4,21 @@ Inspect keys, certificates and signatures locally in the browser.
Crypto Tools is a standalone local-first application in the [add·ideas Toolbox](https://git.add-ideas.de/lotobo/toolbox-portal). Inputs are processed in the browser and are not uploaded.
## Version 0.1 scope
## Current scope
- Bounded PEM and DER inspection for X.509 certificates, CSRs and CRLs
- Identification and fingerprinting of public/private PEM key material without decryption
- PBES2/PBKDF2 encrypted PKCS #8 parameter inspection and password-gated in-memory decryption for WebCrypto-supported AES-CBC/AES-GCM profiles
- Bounded PKCS #12/PFX AuthenticatedSafe, SafeContents and nested bag inventory, including friendly names, local key IDs, X.509 certificates and private-key container metadata
- Password-gated PKCS #12 MacData verification for SHA-1/SHA-2 plus modern PBES2/PBKDF2 AES-CBC/AES-GCM decryption for encrypted SafeContents and shrouded PKCS #8 keys
- Identification and fingerprinting of public/private PEM key material
- JWK/JWKS inspection, private-member warnings and RFC 7638 SHA-256 thumbprints
- Explicit issuer-certificate signature links and DNS SAN hostname checks
- Explicit certificate-path analysis across supplied certificates: issuer DN, AKI/SKI, signature, CA/keyCertSign, path-length and time checks, without claiming trust
- DNS SAN hostname checks
- Concrete, fixed-profile WebCrypto sign/verify operations (RSA-PSS, RSASSA-PKCS1-v1_5, ECDSA P-256 and browser-supported Ed25519)
- Concrete RSA-OAEP SHA-256 and AES-256-GCM text encryption/decryption, with authenticated AES envelopes and explicit size/encoding limits
- A local JSON inspection report with an explicit non-trust model
This is inspection, not complete RFC 5280 path validation, certificate trust, revocation checking, issuance, key generation or general signature verification. Inputs are bounded to 8 MiB and 256 PEM blocks. See [docs/ARCHITECTURE.md](docs/ARCHITECTURE.md) and [docs/PRIVACY-SECURITY.md](docs/PRIVACY-SECURITY.md).
This is not complete RFC 5280 validation, certificate trust, revocation checking, issuance, CMS/JWS tooling, legacy PKCS #1/SEC1 conversion or general-purpose file cryptography. PKCS #12 support intentionally rejects legacy PKCS #12 PBE/RC2/3DES, unknown CMS content, unsupported certificate types and excessive/malformed nesting; it does not implicitly export bag values. Inputs are bounded to 8 MiB and 256 PEM blocks, and password-gated inspection has a shared PBKDF2 work budget. See [docs/ARCHITECTURE.md](docs/ARCHITECTURE.md) and [docs/PRIVACY-SECURITY.md](docs/PRIVACY-SECURITY.md).
## Development
@@ -26,7 +32,7 @@ npm run test:browser
## Release
`npm run release:artifact` creates a deterministic `release/crypto-tools-0.1.0.zip` and checksum sidecar.
`npm run release:artifact` creates a deterministic `release/crypto-tools-0.2.0.zip` and checksum sidecar.
## Licence