New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

ECDH -> AES-GCM Key Derivation for message encryption is broken #28

Closed

reznik99 opened this issue Dec 5, 2022 · 1 comment

Labels

bug

Owner

reznik99 commented Dec 5, 2022

FoxTrot-Front-End/src/global/crypto.ts

Line 55 in 858c87e

const sessionKey = await window.crypto.subtle.deriveKey(

Issues:

Keypair curve is P384 which means the length of output bits is too long.
SubtleCrypto ECDH DeriveKey isn't suitable to directly derive an AES-GCM key directly as it uses the raw DH output and doesn't pass it through any kind of KDF.

Solution is to manually derive the ECDH bits and pass through PBKDF2 to derive the AES-GCM key.

webcrypto/issues/193

Owner Author

reznik99 commented Dec 6, 2022

Resolved
Merge branch 'feature/rsa-msg-encryption'

reznik99 added the bug label

reznik99 closed this as completed

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment