godotengine / godotengine/godot-docs

AESContext i think the example is slightly dangerous

Open
#9,226 0 comments 0 reactions 0 assignees View on GitHub
area:class reference enhancement
Dominant language
reStructuredText
Stars
5.7k
Forks
3.8k
Avg merge
1d 20h
Merged PRs (30d)
25

Description

in the example it is slightly dangerous:

https://docs.godotengine.org/en/stable/classes/class_aescontext.html

the line:
var iv = "My secret iv!!!!" # IV must be of exactly 16 bytes.

the iv in reality is supposed to be changed random each time you send out an encrypted piece of information... this prevents certain types of attacks. The IV is sent unencrypted along with the encrypted data. So an attacker can see the IV each time but it should be random..... i guess this is irritating but i had to make a little function:

```
static func get_random_bytes(count: int) -> PackedByteArray:
randomize()
var bytes = PackedByteArray()
bytes.resize(count)
for i in count:
bytes[i] = randi() % 255
return bytes
```

CBC in the example is the best choice, the ECB i belive is pretty much obsolete

so i don't know if you can hold the users hand, but it's just a potential security loophole if someone follows the example

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.