Enigma: Our powerful and user-friendly cryptographic library

Alessio Paccoia
Mar 19, 2019 · 8 min read
Image for post
Image for post

“The world runs on codes and ciphers, John. From the Million-pound security system at the bank to the Pin machine you took exception to. Cryptography inhabits our every waking moment” — Sherlock Holmes

With the advent of the internet, in fact, privacy has become a primary concern. During the World War II, the Enigma machines were crucial for determining Germany’s triumph and defeat. But in the internet age, the information is natively digital and every computer is a super advanced Enigma machine. It is not surprising then that we have encapsulated our desire for secrecy into code, entrusting computer systems themselves to keep secrets on our behalf. The art of secrecy is no more about stealing cyphers from the enemy field; rather, it is about building machines that are able to communicate with each other without any third party deciphering the message. Nowadays, cryptography has become an indispensable tool for protecting information: our bank account, our emails, our online browsing habits, they are all secured by cryptography. The range of applications is immense. Cryptographic communication is used to privately exchange messages from miles away in just a fraction of a second, but also to safely store personal data that we alone could read back. In the modern world, cryptography is the glue that keeps the world attached.

The quest for the Holy Grail in web crypto libraries

Here at Cubbit we have the dream of decentralizing the data infrastructure and to do so we need a web application on which users are able to save and access their files from anywhere in the world. That’s why we began our search for available web crypto libraries running on the browser. Although a lot of them popped up over the years, no one suited our needs regarding encryption speed and usability for three main reasons:

  • Poor performances when encrypting/decrypting files (cryptography is a computationally intensive application and has typically performed poorly in Javascript).
  • Lack of standards that we need to build our crypto architecture.

Reason #0: web crypto libraries are fiddly

Let’s explore these reasons in depth.

Reason #1: crypto on the web is insecure AND slow

Secondly, the evolution of web technologies has resulted in browsers adopting only Javascript for the sake of simplicity. Nevertheless, Javascript is not the best language for computational heavy tasks, and guess what, cryptography is a computational heavy task. Also, given its increasingly widespread adoption, it is often the first choice by many budding developers at their first experience. Result: many of them started writing bad code, making the language full of security issues.

Reason #2: lack of support for ECC and other standards across many libraries

Finally, none of the libraries we found includes all the standard algorithms we need to implement; for instance, none supported Elliptic-curve cryptography. What’s more, each one of them is suited for a particular encryption protocol more than others, and we make use of a plethora of encryption protocols.

Let’s start

To overcome all these problems we started developing our crypto library in-house. We designed it with three clear goals in mind:

  1. File encryption speed
  2. Never reinvent the wheel unless it’s squared

On the web

We spent hours and hours (re)searching a library with the features and the performances we needed without any success. So we decided to try the compilation path.

const heap_seed = em_array_malloc((self as any).enigma, seed);
ED25519.create_keypair(heap_seed.byteOffset, seed.length);
em_array_free((self as any).enigma, heap_seed);
  1. Cross-compile
  2. Link with your code

On Node.js

Typescript, the typed superset of Javascript by Microsoft, is the hearth of the tech stack here in Cubbit. Thus it would have been natural to build the cryptographic stack in Typescript as well. However, performances and cryptography fit in perfectly with native languages such as C++, while, as we’ve said, Typescript is inappropriate for the task.

Enigma, a fast universal crypto library

And so, after a few months of research and coding, Enigma had come to life.

How to use it

Now you may say: “Ok, cool! But how can I use it?” First of all, you need to install it. Being Enigma an NPM module, you can simply type the following command in your terminal:

npm install @cubbit/enigma
yarn add @cubbit/enigma
Image for post
Image for post
file_stream.pipe(aes_stream).pipe(socket);

The results

We run a suite of benchmarks to compare Enigma to other existing libraries for the web. Here are the results (Chrome 72 on I7-7820HQ - lower is better):

Image for post
Image for post
Image for post
Image for post
AES encryption. Lower is better

Our vision for the future of Enigma


Cubbit — The distributed cloud

Cubbit is on a mission to change the centralized…

Alessio Paccoia

Written by

Lead Developer @Cubbit

Cubbit — The distributed cloud

Cubbit is on a mission to change the centralized architecture of the internet and replace it with a distributed data center-less infrastructure that is free of monthly fees, green and encrypted with zero-knowledge proof.

Alessio Paccoia

Written by

Lead Developer @Cubbit

Cubbit — The distributed cloud

Cubbit is on a mission to change the centralized architecture of the internet and replace it with a distributed data center-less infrastructure that is free of monthly fees, green and encrypted with zero-knowledge proof.

Welcome to a place where words matter. On Medium, smart voices and original ideas take center stage - with no ads in sight. Watch

Follow all the topics you care about, and we’ll deliver the best stories for you to your homepage and inbox. Explore

Get unlimited access to the best stories on Medium — and support writers while you’re at it. Just $5/month. Upgrade

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store