Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

RDF: fix the issue of using encryption/decryption hashed key as the real key for AES #5

Closed
1 of 2 tasks
tian3rd opened this issue Sep 28, 2022 · 1 comment
Closed
1 of 2 tasks
Assignees

Comments

@tian3rd
Copy link
Contributor

tian3rd commented Sep 28, 2022

Just found out that in the encryption/decryption process, the methods use the hashed key as the real key, and this key is actually stored in the encrypted .enc.ttl file in plaintext. This is not right. The right way to do it is to use the original key, but needs to find a way to convert different length to a fixed 32-long in order to use AES.

  • Convert any key to a unique 32 length key
  • Use this secret key to encrypt and decrypt
@tian3rd
Copy link
Contributor Author

tian3rd commented Oct 3, 2022

  • Rather than converting to 32 length key, use sha512 first 32 chars instead for guaranteed security

Hashed key is generated with sha256 for quick verification and is stored in the encrypted file, but the real key is hidden and not stored anywhere, so only when the user's passphrase matches the sh256 key in the encrypted file, then we proceed to decrypt the file:

  1. first generate the real key for AES (256 bits / 32 bytes) with the first 32 chars of sha512
  2. then use this real key to decrypt the content

@gjwgit gjwgit closed this as completed Oct 5, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants