gristlabs / gristlabs/secrets.js
Cryptographic Issues
- Dominant language
- JavaScript
- Stars
- 11
- Forks
- 0
- PR merge metrics
- No merged PRs in 30d
Description
[Please stop encrypting with RSA directly](https://soatok.blog/2021/01/20/please-stop-encrypting-with-rsa-directly/).
https://github.com/gristlabs/secrets.js/blob/e4abb7626b87c7199a8cd57002f5b006453252dc/secrets.js#L23-L28
Also, unauthenticated AES-CBC is vulnerable to padding oracle attacks:
https://github.com/gristlabs/secrets.js/blob/e4abb7626b87c7199a8cd57002f5b006453252dc/secrets.js#L30-L38
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by reading secrets.js lines 23-38 and the linked RSA and AES-CBC security guidance. Determine the intended replacement for direct RSA encryption and unauthenticated CBC, then trace how these choices affect the tool’s public-key secret-sharing flow. Done means both identified cryptographic weaknesses are addressed and the existing behavior remains usable.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- cryptography, security
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100