RATDecoders icon indicating copy to clipboard operation
RATDecoders copied to clipboard

Remove requirement for PyCrypto

Open ralphje opened this issue 4 years ago • 1 comments

pycrypto is no longer maintained and should not be used anymore. An alternative library is pycryptodome, which provides an alternative that is still maintained and suitable for the purposes of this library.

However, note that some functions, such as XOR, are no longer available in pycryptodome, so those should be replaced by something like bytes([a ^ b for a, b in zip(itertools.cycle(key), data)])

There is currently a security vulnerability in pycrypto, so changing this is essential:

╞════════════════════════════╤═══════════╤══════════════════════════╤══════════╡
│ package                    │ installed │ affected                 │ ID       │
╞════════════════════════════╧═══════════╧══════════════════════════╧══════════╡
│ pycrypto                   │ 2.6.1     │ <=2.6.1                  │ 35015    │
╞══════════════════════════════════════════════════════════════════════════════╡
│ Heap-based buffer overflow in the ALGnew function in block_templace.c in     │
│ Python Cryptography Toolkit (aka pycrypto) 2.6.1 allows remote attackers to  │
│ execute arbitrary code as demonstrated by a crafted iv parameter to          │
│ cryptmsg.py.                                                                 │
╘══════════════════════════════════════════════════════════════════════════════╛

ralphje avatar May 19 '20 10:05 ralphje

Thansk, will take a look and start working through them.

kevthehermit avatar Jun 11 '20 12:06 kevthehermit