triplesec

Triple Security for the browser and Node.js

Web Development Security & Privacy

Explore on GitHub Read Hacker News discussions

4Distinct people

4Mentions

0Explicit recommenders

402GitHub stars

REPOSITORY AT A GLANCE

What to know before exploring

What it is

Triple Security for the browser and Node.js

GitHub

Where it is used

No documented product use has been verified yet.

What people are saying

No recommendation phrase was found in the indexed comments.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

No other repository is repeatedly linked in the same discussions.

This week on Hacker News

Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 12:54:37 PM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by year4 dated mentions

Observed mentions: 2013-09-17 21:31:24 UTC to 2017-03-08 16:56:55 UTC.

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges

UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
Period	Start (UTC)	End (exclusive, UTC)	Mentions	Comments
2013	2013-01-01 00:00:00 UTC	2014-01-01 00:00:00 UTC	2	2
2014	2014-01-01 00:00:00 UTC	2015-01-01 00:00:00 UTC	0	0
2015	2015-01-01 00:00:00 UTC	2016-01-01 00:00:00 UTC	1	1
2016	2016-01-01 00:00:00 UTC	2017-01-01 00:00:00 UTC	0	0
2017	2017-01-01 00:00:00 UTC	2018-01-01 00:00:00 UTC	1	1

What Hacker News says

4 sources

calebm·Mar 8, 2017

On a related note, I made a little browser-based file encryption app: https://hypervault.github.io/ which uses the Triplesec library (https://github.com/keybase/triplesec), which seemed a nice alternative to SJCL. Since I know someone will bring up the insecurity of browser crypto: this app is entirely self-contained (the HTML file can be saved and run offline).

In SJCL – Stanford JavaScript Crypto Library

sarciszewski·Jun 3, 2015

> I wouldn't say this is bad or anything I would. The idea might not be bad, but the implementation is. They use a pure software AES implementation that, due to its reliance on S-boxes, opens the door for cache-timing attacks. Offending file: https://github.com/keybase/triplesec/blob/master/src/aes.ice... Permalink: https://github.com/keybase/triplesec/blob/bb0b2f449cc28ca402... Issue: https://github.com/keybase/triplesec/issues/47 (opened March 17, still collecting dust) Reference: http://cr.yp.to/antiforgery/cachetiming-20050414.pdf AES-NI or bust. > The FAQ says something about plans for a future streaming API. Please do not do this, at least for the decrypt operation. Streaming decryption APIs expose application developers to not-yet-authenticated plaintext. I've written a streaming PoC to encrypt/decrypt file handles in PHP. During t

Read the rest

he decryption process, it first recalculates the HMAC over the entire file then verifies it with the one stored before decrypting. (Yes, in constant time too.) It's slower than just blindly decrypting, but more trustworthy. Not quite the same as streaming network resources, but I figured that bit of nuance is worth mentioning. The experiment lives here if you're interested in schooling me on some matter I overlooked, though I'm going to significantly rewrite it before I propose it to the project I was PoCing it for: https://github.com/paragonie-scott/php-crypto-stream (For starters, the actual pull request won't be using CBC.)

In TripleSec – Symmetric Encryption in the Browser Combining AES, Salsa20, Twofish

WizzleKake·Nov 28, 2013

How'd you get the crypto_scrypt() call to go so fast? one call to crypto_scrypt takes about a second on my machine. The pbkdf2 is the fast part. I'm using the crypto_scrypt from here: https://github.com/keybase/triplesec/tree/master/contrib/scr...

In The WarpWallet Challenge

maxtaco·Sep 17, 2013

It's all on GitHub. Please let me know of any bugs you find, and thanks. I did test the implementation against whatever test vectors I could find, but obviously carry code is tricky and error-prone. Link here: https://github.com/keybase/triplesec/blob/master/src/ctr.ice...

In Announcing TripleSec - JavaScript encryption combining Salsa20, AES, and 2fish