msrCrypto is a JavaScript cryptography library, originally developed by Microsoft Research and subsequently maintained by Kevlened. It serves as a polyfill for the W3C Web Cryptography API, enabling modern cryptographic primitives like RSA-OAEP, AES-CBC, SHA-256/384/512, HMAC, ECDH, and ECDSA in environments where native Web Crypto API support is absent or inconsistent. Its primary differentiation is its broad browser compatibility, extending to older browsers like Internet Explorer 8, 9, 10, and 11, alongside modern browsers. Since version 1.4, it has adopted a Promise-based API for asynchronous operations, aligning with the Web Crypto API specification. The current stable version, as per the user's input, is 1.5.8, though a `1.6.5` version appears on npm under `@dashdot/msrcrypto` with the last publish 4 years ago, and `1.5.8` itself was published 6 years ago. Its release cadence appears infrequent, with updates primarily addressing API compliance, security bug fixes, and feature enhancements for specific algorithms.
npm install msrcryptoVerified import paths — ran on the pinned version, not inferred.
This quickstart demonstrates how to generate an AES-CBC key and encrypt a plain text message using the `msrCrypto.subtle` API, mimicking the Web Crypto API. It highlights the promise-based asynchronous operations.
Rewrite cryptographic operations to use the `.then().catch()` Promise syntax instead of assigning `onComplete` and `onError` handlers.
Upgrade to version 1.4.1 or higher immediately to apply critical security patches and ensure correct elliptic curve cryptography.
Access the `catch` method using bracket notation: `promise['catch'](function(error) { ... });`.Implement logic to convert between Typed Arrays and regular Arrays based on browser capabilities, or use regular Arrays universally if targeting IE8/9. A common workaround is a simple `Uint8Array` wrapper for regular `Array`s when Typed Arrays are not supported.
Disable automatic web worker usage if bundling, or ensure that the bundled script's path is correctly resolvable by `new Worker()`. The `1.6` version (under `@dashdot/msrcrypto`) disables automatic web-worker usage by default to mitigate this.
Obtain cryptographically secure random bytes from a trusted source (e.g., a server-side crypto API over HTTPS) and use `window.msrCrypto.initPrng(randomBytesArray)` to seed the PRNG before any other crypto calls on affected browsers. Modern browsers will use `window.crypto.getRandomValues` to seed it automatically.
Update your code to use the Promise-based `.then()` and `.catch()` syntax for cryptographic operations.
Use bracket notation to access the `catch` method: `promise['catch'](function(error) { /* handle error */ });`.Ensure `msrcrypto.js` is included in your HTML using a `<script>` tag before any code attempts to access `msrCrypto`. Verify the script path is correct and accessible.
Provide input data as regular JavaScript Arrays and handle returned data as regular Arrays when targeting IE8/9. For IE10+, `ArrayBuffer` is used. You may need to write compatibility layers.
Modify your CSP to allow worker scripts. For example, add `worker-src 'self' blob:` or `script-src 'self' blob:` depending on how your workers are loaded. Alternatively, bundle `msrCrypto` in a way that disables web workers, or use a version that has web workers disabled by default (e.g., `@dashdot/msrcrypto@1.6`).
No dependency data recorded yet.