cryptpad / cryptpad/chainpad

sha256 does not convert strings to bytes properly

Open
#13 2 comments 0 reactions 0 assignees View on GitHub
Dominant language
JavaScript
Stars
409
Forks
29
PR merge metrics
No merged PRs in 30d

Description

This is a problem for ever upgrading the sha256 implementation used. As far as I know the actual algorithm is fine but the conversion of strings to bytes silently drops upper codepage characters, doing effectively a `string.charCodeAt(i) & 0xff`. This was not obvious at first because the sha256 implementation uses an array of integers rather than bytes in order to be faster so the conversion involves some bit-shifting and is not obvious in it's intent.

An actual result of this is there is a possibility for a patch containing UTF to be disguised as one which doesn't, but this is unlikely to happen accidentally and there is no security implication as this sha256 is for integrity only.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by locating the JavaScript sha256 implementation and tracing how strings become the integer array used by the algorithm. Compare hashes for strings containing upper codepage and UTF characters, then verify that conversion preserves the intended characters without changing the algorithm. Done means those inputs are represented correctly and the relevant hash results are covered by tests.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
cryptography
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.