sha256 does not convert strings to bytes properly
- Dominant language
- JavaScript
- Stars
- 409
- Forks
- 29
- PR merge metrics
- No merged PRs in 30d
Description
This is a problem for ever upgrading the sha256 implementation used. As far as I know the actual algorithm is fine but the conversion of strings to bytes silently drops upper codepage characters, doing effectively a `string.charCodeAt(i) & 0xff`. This was not obvious at first because the sha256 implementation uses an array of integers rather than bytes in order to be faster so the conversion involves some bit-shifting and is not obvious in it's intent.
An actual result of this is there is a possibility for a patch containing UTF to be disguised as one which doesn't, but this is unlikely to happen accidentally and there is no security implication as this sha256 is for integrity only.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by locating the JavaScript sha256 implementation and tracing how strings become the integer array used by the algorithm. Compare hashes for strings containing upper codepage and UTF characters, then verify that conversion preserves the intended characters without changing the algorithm. Done means those inputs are represented correctly and the relevant hash results are covered by tests.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- cryptography
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100