gchq / gchq/CyberChef

Bug report: PBKDF2-same output for different inputs

Open
#2,072 1 comment 0 reactions 0 assignees View on GitHub
bug
Dominant language
JavaScript
Stars
35.8k
Forks
4.1k
Avg merge
2d 26m
Merged PRs (30d)
33

Description

When I use the salt same outputs occures for different inputs.
Link to reproduce:
https://gchq.github.io/CyberChef/#recipe=Fork('%5C%5Cn','%5C%5Cn',false)Derive_PBKDF2_key(%7B'option':'UTF8','string':''%7D,128,1,'SHA1',%7B'option':'UTF8','string':'anysalt'%7D)&input=aW5wdXQxCmlucHV0MgppbnB1dDM

Without salt they are different.
I'm using it in Firefox browser on Win10.

Contributor guide

Open the contributing guide

Research direction

Start with the linked CyberChef recipe and its Derive_PBKDF2_key operation, reproducing the salted case in Firefox with the three inputs shown. Compare the derived outputs for different inputs and verify that the fix preserves the distinct unsalted outputs; done means different inputs no longer produce the same salted result.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
cryptography
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.