Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

AESContext i think the example is slightly dangerous #9226

Open
RichardEllicott opened this issue Apr 14, 2024 · 0 comments
Open

AESContext i think the example is slightly dangerous #9226

RichardEllicott opened this issue Apr 14, 2024 · 0 comments
Labels
area:class reference Issues and PRs about the class reference, which should be addressed on the Godot engine repository enhancement

Comments

@RichardEllicott
Copy link

RichardEllicott commented Apr 14, 2024

in the example it is slightly dangerous:

https://docs.godotengine.org/en/stable/classes/class_aescontext.html

the line:
var iv = "My secret iv!!!!" # IV must be of exactly 16 bytes.

the iv in reality is supposed to be changed random each time you send out an encrypted piece of information... this prevents certain types of attacks. The IV is sent unencrypted along with the encrypted data. So an attacker can see the IV each time but it should be random..... i guess this is irritating but i had to make a little function:

static func get_random_bytes(count: int) -> PackedByteArray:
    randomize()
    var bytes = PackedByteArray()
    bytes.resize(count) 
    for i in count:
        bytes[i] = randi() % 255
    return bytes

CBC in the example is the best choice, the ECB i belive is pretty much obsolete

so i don't know if you can hold the users hand, but it's just a potential security loophole if someone follows the example

@skyace65 skyace65 added the area:class reference Issues and PRs about the class reference, which should be addressed on the Godot engine repository label Apr 14, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
area:class reference Issues and PRs about the class reference, which should be addressed on the Godot engine repository enhancement
Projects
None yet
Development

No branches or pull requests

2 participants