Repository navigation
crypto,doc: update language around key stretching #19748
Description
doc/api/crypto.md currently says this:
it is recommended that developers derive a key and IV on their own using
crypto.pbkdf2()
That's only sound when the key+IV are used once. Using the same key+IV twice is undesirable in general and downright disastrous with counter mode ciphers:
- identical plaintexts encrypt to the same ciphertext (usually not what you want)
- leaks information about the initial plaintext block with CBC and CFB ciphers
- completely destroys the security of CTR, GCM and OFB ciphers
It would be good to add some guidelines on how to safely create and store IVs. They should be unpredictable but don't need to be kept secret after encrypting. Are there exceptions to this rule?
Refs: indexzero/nconf#299
Activity
tniessen commentedon Apr 2, 2018
Not that I know of. One can think of a cipher
Ewhich uses an IVNas a parameterized algorithm whose only inputs are key and message (c = EN(k, m)), and in this case the IV need not be secret according to Kerckhoff's principle.It is not strictly necessary to use a KDF to produce the IV, and it is valid to reuse a key with different IVs to some extent.
ryzokuken commentedon Apr 3, 2018
@bnoordhuis @tniessen could I pick this up? We could discuss the specifics of the addition.
ryzokuken commentedon Apr 3, 2018
As per my understanding of IVs,
Let me know if I'm missing something or if something's wrong with my understanding of IVs.
bnoordhuis commentedon Apr 4, 2018
@ryzokuken Yes, that's correct.
ryzokuken commentedon Apr 4, 2018
@bnoordhuis in that case, should I add this particular paragraph to the docs to make it explicit? I believe it sums the whole thing up.
bnoordhuis commentedon Apr 4, 2018
Sounds good. As long as it doesn't insinuate that IV reuse is okay, like it currently does.
ryzokuken commentedon Apr 4, 2018
@bnoordhuis Correct me if I'm wrong, but I think this only appears in the documentation for
crypto.createDecipherandcrypto.createCipher. Aren't they both deprecated anyway?My point here being: if I add the paragraph, do I add it to
crypto.createCipherorcrypto.createCipherivwhich is not deprecated, but doesn't have this exact text in its description anyway?bnoordhuis commentedon Apr 4, 2018
I'd add them to all four, yes.
That's right.
ryzokuken commentedon Apr 4, 2018
@bnoordhuis making a PR. That said, should I add the exact same text to all four functions?
ryzokuken commentedon Apr 4, 2018
Oh, wait.
createCipherandcreateDecipherdon't actually take an IV as an argument. Do they still need it?ryzokuken commentedon Apr 4, 2018
I added the text to
createCipherivandcreateDecipheriv. If you think it's necessary, I'd add the same to the remaining two functions.doc: update language regarding key stretching
doc: update language regarding key stretching