-
Notifications
You must be signed in to change notification settings - Fork 41
Open
Description
Hi, I've noticed that the AES encryption implementation in this repository uses a fixed IV value (e.g., 16 * b'\x00').
Using a static IV in modes like CBC can lead to serious security vulnerabilities, as it allows attackers to detect patterns in encrypted data and potentially decrypt or manipulate it.
According to cryptographic best practices, IVs should be randomly generated for each encryption operation to ensure confidentiality and prevent attacks.
Would it be possible to update this in future releases by replacing the static IV with a secure, randomly generated IV?
The line that I noticed is as follows.
Lines 14 to 15 in c638d36
| iv = 16 * b'\x00' | |
| cipher = AES.new(hashlib.sha256(KEY).digest(), AES.MODE_CBC, iv) |
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
No labels