hugo_encryptor icon indicating copy to clipboard operation
hugo_encryptor copied to clipboard

change cipher to aes-128-gcm

Open sieveLau opened this issue 3 years ago • 2 comments

What this does:

  1. split the javascript used for decryption into a seperate file
  2. change cipher from aes-cbc to aes-gcm

About 1, pros and cons are described in #20

Reasons for 2:

  • see #18

Dependencies changed:

  • CryptoJS doesn't support aes-gcm, I use forge to fulfil the requirement
  • pycrypto doesn't support aes-gcm, I use pycryptodome to fulfil that

sieveLau avatar May 26 '21 09:05 sieveLau

If we accept to use aes-gcm to encrypt the content, the password hashing part would be the next part to be strengthened. After all, md5 is too fast for password hashing, but we need a slow one.

On the other hand, if the encryptor is fed with a lot of htmls which require encryption, the hashing algorithm can't be slow.

sieveLau avatar May 26 '21 13:05 sieveLau

This can also fix #24 . https://stackoverflow.com/questions/70705404/systemerror-py-ssize-t-clean-macro-must-be-defined-for-formats

So are there any update on this?

zerofancy avatar Feb 11 '23 18:02 zerofancy