Questions about sha256 and salt used
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 7.2k
- Forks
- 493
- PR merge metrics
- No merged PRs in 30d
Description
I've got some questions when browsing the source code.
-
The sha256 here is used to generate the key from secret. But sha256 itself is not a secure algorithm for key derivation. Some other algorithms like PBKDF2 will be better.
-
Why the salt and IV are the same here, they are supposed to be different to provide security.
I think these two may lead to potential vulnerabilities.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by inspecting lbry/crypto/crypt.py at the sha256 usage near line 19 and the salt and IV handling near line 46. Compare the key-derivation and encryption parameters with the issue's security concerns; done means the vulnerability assessment is resolved and any required change is clearly defined and verified.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- cryptography, security
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 20/100