SimpleCrypto is Vulnerable to Chosen-Ciphertext Attacks about simple-crypto-js HOT 7 CLOSED

NPM release should be available in a moment.

from simple-crypto-js.

@paragonie-scott Thanks for the recommendation. Should have been considered before. I'll try to implements a better algorithm.

from simple-crypto-js.

If you don't have any of the algorithms available to you, you might have to follow in the footsteps of @defuse and implement AES-CTR + HMAC-SHA2 (Encrypt then MAC) as detailed here.

It's less simple internally, but it'll remain simple for your users.

from simple-crypto-js.

👋 Hey! We've recently opened a bug bounty against this issue, so if you want to get rewarded 💰 for fixing this vulnerability 🕷, head over to https://huntr.dev!

from simple-crypto-js.

Hey, guys. I'm facing the following problem: if I add any characters to the end of an encrypted string, the decrypt function will still decrypt correctly. This is a huge problem for me because I'm using the simpleCrypto to generate a unique code and I cannot have two different encrypted strings resulting in the same decrypted object.

from simple-crypto-js.

See #17 for a suggested fix.

from simple-crypto-js.

Sorry for very late reply. Already merged #17.

from simple-crypto-js.