unix4fun / ic Goto Github PK

on receiving an old message replay from a nick who previously sent it (like nick stealing) the nonce might be resetted down to a previous value and then it might be re-used, hence making a tuple (key, nonce) re-used more than once.

When the sender is writing with accentuated character, his messages are never seen by the receiver. As far as I know, no error messages are given, so its almost impossible for the sender to know about this problem.

when re-enabling encryption after peer was disconnected, after /pk and /sk, when the encryption is enabled again, the red nickname bar is duplicated.

hashing concatenated user controlled data to define the nonce value can alter the ability to produce a unique value since channel and src_nick can be leveraged to produce similar results concatenated while being different independently.

fix: modify the nonce_auth computing by hash each value independently and hashing the concatenation of each value, this will break compatibility with old version of ac, need to be recompiled.

nb: will tag previous release before making the breaking change.