FIX: Stop Using Raw Shared Secrets as Encryption Keys #6

Merged

vxfemboy merged 2 commits from crypt-ooopsies into main

2025-03-11 18:26:33 +00:00

vxfemboy commented

2025-03-11 18:17:00 +00:00

(Migrated from github.com)

This commit fixes a catastrophic security vulnerability where
raw shared secrets were being used directly as encryption keys and nonces.

Fuzzy fixes include:

Added proper key derivation with sha256 KDF for shared secrets
Extracted separate encryption keys with distinct context strings
Derived nonces properly instead of reusing key material
Added tests to verify our paw-some encryption

These changes ensure our cryptokitty implementation follows best practices
and properly protects our sensitive whiskers... err, I mean data!

Closes #2
<3 much luv and many thanks too @G1gg1L3s and @nbraud for pointing this out

This commit fixes a **catastrophic** security vulnerability where raw shared secrets were being used directly as encryption keys and nonces. **Fuzzy fixes include:** - Added proper key derivation with sha256 KDF for shared secrets - Extracted separate encryption keys with distinct context strings - Derived nonces properly instead of reusing key material - Added tests to verify our paw-some encryption These changes ensure our cryptokitty implementation follows best practices and properly protects our sensitive whiskers... err, I mean data! _Closes #2_ _<3 much luv and many thanks too @G1gg1L3s and @nbraud for pointing this out_

vxfemboy commented

2025-03-11 18:24:35 +00:00

(Migrated from github.com)

all tests seem to pass

test cipher::tests::test_edge_cases ... ok
test cipher::tests::test_multi_byte_encryption ... ok
test cipher::tests::test_basic_encryption_decryption ... ok
test cipher::tests::test_pattern_consistency ... ok
test keys::tests::test_encrypt_decrypt_empty_data ... ok
test keys::tests::test_decrypt_invalid_data ... ok
test keys::tests::test_encrypt_decrypt_roundtrip ... ok
test cipher::tests::test_dialect_switching ... ok
test keys::tests::test_encrypt_decrypt_large_data ... ok
test keys::tests::test_different_keypairs ... ok

all tests seem to pass ``` test cipher::tests::test_edge_cases ... ok test cipher::tests::test_multi_byte_encryption ... ok test cipher::tests::test_basic_encryption_decryption ... ok test cipher::tests::test_pattern_consistency ... ok test keys::tests::test_encrypt_decrypt_empty_data ... ok test keys::tests::test_decrypt_invalid_data ... ok test keys::tests::test_encrypt_decrypt_roundtrip ... ok test cipher::tests::test_dialect_switching ... ok test keys::tests::test_encrypt_decrypt_large_data ... ok test keys::tests::test_different_keypairs ... ok ```

vxfemboy commented

2025-03-11 18:26:06 +00:00

(Migrated from github.com)

bumped dependency versions

G1gg1L3s commented

2025-03-11 18:29:05 +00:00

(Migrated from github.com)

🐱🔒 Meow-gnificent job!

❤️ 1