Zerobinpaste updates: seed prng from /dev/(u)random, shorter keys #41

Merged
merged 2 commits into from May 4, 2013

Conversation

Projects
None yet
3 participants
@mk-fg
Contributor

mk-fg commented Apr 29, 2013

Finally got around to poke js for alternative encryption methods and haven't really found anything marginally better to justify the effort of swapping the current scheme - shorter keys can already be fairly safe due to pbkdf2 in place (though 1k iterations isn't much at all).

What I found however is that sjcl doesn't seem to be written with node.js in mind and its sjcl.random doesn't try to seed prng (used for key and ccm nonce) from system entropy sources like /dev/random and /dev/urandom, so 415516e addresses that.

118b0ce uses much shorter 48-bit keys (8 chars), still allowing user to configure arbitrarily-longer ones (should be easy to do via ~/.zerobinpasterc).
That isn't much, but still probably more than most of the user passwords/passphrases have.
Given that superb security against such attacks isn't vital here (decryption js is quite likely to be served over http/bad-tls anyway), I think it's a sane default with a length trade-off in mind.
If not a good default, can be changed to anything in the option parsing code there, but the option itself is still worth having, I think.

Combined with cb8e52b (will open separate PR), urls go from this:

http://some.0bin.site/paste/9611846d1c86e549fabe205837d40b780f5efce3#bLilFEQok1qTOzifX2gdvZO1ZoHki1getSt/YnAdAFQ=

To this:

http://some.0bin.site/paste/FxsUsOGB#aW8DhwMy

As these keys are purely client-side, there should be no compatibility issues of any kind.

sametmax added a commit that referenced this pull request May 4, 2013

Merge pull request #41 from mk-fg/zerobinpaste_updates
Zerobinpaste updates: seed prng from /dev/(u)random, shorter keys

@sametmax sametmax merged commit 04099c6 into sametmax:master May 4, 2013

@mk-fg mk-fg deleted the mk-fg:zerobinpaste_updates branch May 4, 2013

@898

This comment has been minimized.

Show comment
Hide comment
@898

898 Jan 17, 2014

need this dump

898 commented on 415516e Jan 17, 2014

need this dump

This comment has been minimized.

Show comment
Hide comment
@mk-fg

mk-fg Jan 17, 2014

Contributor

Don't understand what you mean by that. What dump?

Contributor

mk-fg replied Jan 17, 2014

Don't understand what you mean by that. What dump?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment