-
Notifications
You must be signed in to change notification settings - Fork 145
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
fix(wallet): set Argon2 derived bytes for AES IV #1703
Conversation
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #1703 +/- ##
==========================================
+ Coverage 75.07% 76.18% +1.10%
==========================================
Files 234 242 +8
Lines 12156 18668 +6512
==========================================
+ Hits 9126 14222 +5096
- Misses 2582 3983 +1401
- Partials 448 463 +15 🚀 New features to boost your workflow:
|
defaultIterations = 3 | ||
defaultMemory = 65536 // 2 ^ 16 | ||
defaultParallelism = 4 | ||
defaultKeyLen = 48 |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I can't find recommended value for KeyLen
and what is it keylen?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Check above explanation
Description
This PR updates the encryption logic to use Argon2-derived bytes for the Initialization Vector (IV) in AES, replacing the legacy approach of reusing the salt as the IV.
Explanation:
In the legacy or previous approach, we used the same salt in the Password Hasher (Argon2 in this case) as the Initialization Vector (IV) for the AES encryption algorithm. The seed is random and should not be an issue, but some documentation recommends never reusing a seed, even for different purposes.
To address this, we propose extending the key length from 32 bytes to 48 bytes, using the first 32 bytes as the encryption key and the remaining 16 bytes as the IV.
In OpenSSL, the salt is public. I found this code.
The encrypted files usually start with
Salted__
.Based on this documentation, the IV is derived from the password in OpenSSL. Check the
-iv
section:We follow the same approach in this PR. Here I found the code that generates IV in OpenSSL.