anusii / anusii/solidpod

SOLIDPOD: Encryption is unauthenticated (AES-CTR with no MAC)

Open
#663 1 comment 0 reactions 1 assignee View on GitHub

@anushkavidanage is already working on this.

Since Jun 18, 2026.

Dominant language
Dart
Stars
10
Forks
7
Avg merge
1d 3h
Merged PRs (30d)
6

Description

In the current solidpod implementation, data is encrypted using AESMode.sic is CTR mode. CTR is malleable: flipping a bit in ciphertext flips the same bit in the decrypted plaintext, and decryption succeeds silently. Furthermore, there is no MAC, no GCM tag, no AEAD anywhere in solidpod.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.