blobfile icon indicating copy to clipboard operation
blobfile copied to clipboard

Replace pkcs1_15 with PKCS#1 OAEP (RSA) for secure encryption

Open kexinoh opened this issue 6 months ago • 0 comments

I found an issue in the _gcp.py file at line 55 (https://github.com/blobfile/blobfile/blob/dd9459f0af08efe852827d0d29c54f1e20529177/blobfile/_gcp.py#L55). The code currently imports pkcs1_15 from Cryptodome.Signature:

from Cryptodome.Signature import pkcs1_15 However, it is recommended not to use pkcs1_15 due to security concerns. Instead, it should be replaced with PKCS#1 OAEP (RSA) for more secure encryption.

For the specific code modification, please refer to the documentation: https://pycryptodome.readthedocs.io/en/latest/src/cipher/pkcs1_v1_5.html

kexinoh avatar Aug 04 '24 16:08 kexinoh