New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Questions about sha256 and salt used #3737

Open

Gax-c opened this issue Apr 4, 2024 · 0 comments

Gax-c commented Apr 4, 2024

I've got some questions when browsing the source code.

The sha256 here is used to generate the key from secret. But sha256 itself is not a secure algorithm for key derivation. Some other algorithms like PBKDF2 will be better.
Why the salt and IV are the same here, they are supposed to be different to provide security.

I think these two may lead to potential vulnerabilities.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment