bisq-network / bisq-network/bisqremote

Entropy of initialisation vector

Open
#7 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
2
Forks
8
PR merge metrics
No merged PRs in 30d

Description

Make sure that the iv which is used in each message sent from Bisq has 32 bit of entropy.

In bisq/notification/BisqNotification.java, line 46, we use:
String iv = uuid.substring(0, 16);
which provides only 16+8 = 24 bit of entropy.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start in bisq/notification/BisqNotification.java at line 46 and inspect how the UUID-derived IV is generated and used for each message. Verify the resulting IV provides 32 bits of entropy and confirm that each sent message uses the corrected value.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
cryptography, security
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.