Skip to content
This repository has been archived by the owner on Mar 28, 2018. It is now read-only.

Consider using libsodium instead of RSA-PKCS1 #17

Closed
paragonie-scott opened this issue Jun 17, 2015 · 2 comments
Closed

Consider using libsodium instead of RSA-PKCS1 #17

paragonie-scott opened this issue Jun 17, 2015 · 2 comments

Comments

@paragonie-scott
Copy link

Cipher cipher = Cipher.getInstance("RSA/ECB/PKCS1Padding");

Referring to (Updated) Cryptographic Right Answers:

  • If you're going to use RSA, use RSA-OAEP, not RSA-PKCS1
  • ECB mode should never be used for encrypting sensitive information

If you would like, Paragon Initiative Enterprises can audit your entire application and harden your cryptography protocols while preventing other security risks (gratis).

@paragonie-scott
Copy link
Author

If you are interested, Robosodium ought to be a good shim for a modern, fast, and secure elliptic curve cryptography library (libsodium, which is a portable fork of NaCl).

@markharding markharding changed the title Weak cryptography (RSA-PKCS1, ECB mode) Consider using RSA-OAEP in place of RSA-PKCS1 Jun 24, 2015
@paragonie-scott
Copy link
Author

This title change is incorrect. Instead of "consider using RSA-OAEP", it should read, "consider using libsodium".

@paragonie-scott paragonie-scott changed the title Consider using RSA-OAEP in place of RSA-PKCS1 Consider using libsodium instead of RSA-PKCS1 Jun 24, 2015
markharding pushed a commit that referenced this issue Mar 27, 2017
* (fix): Refresh points counter when re-logging and add pull to refresh on wallet view (#19)

* (feat): Re-sync discovery entity when loading full-screen (#17)

* (feat): Be able to click post date to original post page (#16)

* (fix): ios icon

* (fix): Boost rejected notification typo (#21)

* (fix) : Reminds don't take you to the original post (#23)

* (fix): Link images and blogs on notifications (#20)

* (fix): Wrong storage key for points animation toggle (#22)

* (feat): Improve back button visibility (z-index and outline) (#18)

* (fix): prevent navigation become dead when pop is happening

* (chore): improve unread and online icons

* (feat): Implement comment attachments and rich embeds

* (feat): Allow setting explicit comments and show them blurred
markharding pushed a commit that referenced this issue Mar 27, 2017
…nimation when on background (#28)

* (fix): Refresh points counter when re-logging and add pull to refresh on wallet view (#19)

* (feat): Re-sync discovery entity when loading full-screen (#17)

* (feat): Be able to click post date to original post page (#16)

* (fix): ios icon

* (fix): Boost rejected notification typo (#21)

* (fix) : Reminds don't take you to the original post (#23)

* (fix): Link images and blogs on notifications (#20)

* (fix): Wrong storage key for points animation toggle (#22)

* (feat): Improve back button visibility (z-index and outline) (#18)

* (fix): prevent navigation become dead when pop is happening

* (chore): improve unread and online icons

* (feat): Create App Status service and disable points animation when on background
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant