Consider using aes-256-gcm about beekeeper-studio HOT 3 CLOSED

What's the benefit of gcm?

from beekeeper-studio.

This is not a big deal but it appears that GCM was not easily supported when a key reference was first used but I think it is now and even that reference has been updated. (see https://lollyrock.com/posts/nodejs-encryption/)

There are several reasons I brought it up:

1. GCM is authenticated encryption, CTR is not
2. In theory GCM should be faster because it can parallelize (it builds on CTR which can do this, but if I understand you have to have to do this yourself) and there are hardware optimizations. (This may not be relevant if you're only encrypting a very small unit of data)

I would also note that both of these algorithms use an initialization vector (IV) that should be random, as you can see in the SubleCrypto examples: https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto/encrypt.

This documentation from the node.js crypto package suggests that the method you are using without the IV is deprecated: https://nodejs.org/api/crypto.html#crypto_crypto_createcipher_algorithm_password_options

I hope this helps...

See:
https://en.wikipedia.org/wiki/Authenticated_encryption
https://www.quora.com/What-is-the-difference-between-Galois-Counter-Mode-and-Counter-Mode-AES
https://stackoverflow.com/questions/1220751/how-to-choose-an-aes-encryption-mode-cbc-ecb-ctr-ocb-cfb
https://crypto.stackexchange.com/questions/62029/does-an-iv-need-to-be-used-in-aes-ctr-mode
https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto/encrypt
https://web.cs.ucdavis.edu/~rogaway/papers/modes.pdf

from beekeeper-studio.

Thanks for all the detail!

The encryption right now is only for data that lives on a user's local machine. Many similar apps don't even bother encrypting stuff that is stored locally, even sensitive information, so I feel ok about our current solution.

I'm going to close this issue, but have bookmarked it for if we ever do some sort of remote syncing feature (when data encryption becomes an important part of the solution)

from beekeeper-studio.