Some days ago I found this JavaScript library for client side encryption using standard crypto algorithms. Everything done in the browser. Cool!
Stanford Javascript Crypto Library: http://crypto.stanford.edu/sjcl/ – They say: “It uses the industry-standard AES algorithm at 128, 192 or 256 bits; the SHA256 hash function; the HMAC authentication code; the PBKDF2 password strengthener; and the CCM and OCB authenticated-encryption modes.”
Based on this I wanted to create a client side SharePoint List Item crypt module to encrypt (text) data in the users browser. So the data is stored in SharePoint encrypted. No one can read it without having the password.
Here is the code:
http://splistitemcrypt.codeplex.com/
It’s a coding exercise, nothing more!!!! Read the limitations below and be sure: there are more limitations I do not know at the moment…
My solution is very simple: I created a Visual Web Part with Visual Studio 2012. This web part contains everything I need for encryption / decrpytion.
1. It contains the Standford Javascript Crypto Library.
2. It contains a copy of jQuery 1.10.1.
3. It contains a Base64 serialized image that is used to mark input fields as “encryption protected”.
4. Some custom javascript.
That’s it. Small footprint. – The web part needs to be placed on each list form (new / edit / display) and on each list view page. Everything else is done by the Web Part.
Benefits:
- Client side data encryption.
- Industry standard encryption. Theoretically possible to decrypt the data later outside of SharePoint using the correct password and some tools / libraries.
- You can share the password with anyone who needs to decrypt the data. It’s not bound to your user account.
Limitations – be careful to read and understand them before using it in any way. – There are more limitations. The list is not complete!!!
- First of all: It’s a single-person’n’quick-done demo project. Nothing for production use. – You could use your data! – I’m responsible for any problems.
- Works only for text fields and multi line text fields without HTML formatting.
- (Single line) text fields in SharePoint are limited to 255 characters length. The encrypted data is stored as Base64 in the field. So it’s not possible to encrypt 255 characters to the same amount of data: 255 bytes of plain text chars are much more that 255 bytes in encrypted state. SharePoint and my module does not handle this situation. (Because it’s a demo project not a product 😉 )
- If you loose the password there is no way (other than “brute force”) to get your data back. There is no back door.
- The data cannot be searched. – You should exclude the list from being crawled.
- No way to change the password. – If this will be possible in the future than there will be no way to migrate already encrypted data. This is because it’s client side encryption. The server does never now the password. So it cannot migrate the data from the current version of the project to a new version.
- No inline edit on list view pages!
- No “decrypt” option to permanently remove encryption.
At all: The project is not perfect, in any way.
Here is a step-by-step guide of how to use it:
1. Create a site collection.
2. Add a custom list called “Crypted Data”.
3. Add a new multi line text column as “plain text”
4. Click “New item”. This is the default “New” form.
5. To add the crypto web part choose “Edit Page” from the site actions menu. Click “Add a Web Part”. Select category “Custom”, select web part “ikarstein’s List Item Crypt” and zone “Main”. Then click button “Add”.
6. Now you get a form section on the form asking for your password, because the password cache of your browser is empty.
7. After you enter the password and click the button “Set Password” you see lock icons behind the two text fields. These are added dynamically by the crypto web part.
8. Now you can add data as normal to the list item:
9. On saving the list item you will see the encrypted content for a short time. Before the encrypted and Base64 encoded data you see a prefix @@*[ – This I use to identify encrypted values.
10. After saving and back on the list view page you see this:
After adding the web part to the list view page you see this (automatically):
the values are decrypted using the browser cached password.
11. The same for edit form and display form. If you do not add the web part you will see the encrypted values. Like here:
After editing the form page you see the decrypted values:
The same for edit…
After you edit the web part you can edit the decrypted values and change them:
Some changes and saving it. This is the list view afterwards:
12. The inline edit mode does not work!!!
It’s very simple. Look at the code on CodePlex. Just one note: The web party loads its own jQuery version only if the page does not contain jQuery already.
.
