Skip to content
This repository has been archived by the owner on Feb 2, 2024. It is now read-only.

feat: add cipher for async and sync #34

Closed
wants to merge 1 commit into from

Conversation

jadok
Copy link

@jadok jadok commented Feb 21, 2019

Why

Currently, the async is not stable for production.
The sync librarie does not provide the possibility to use cipher.

The crypto-js librarie provides the ability to use cipher, padding, and mode which will improve the crypting.

What

  • This PR implement cipher, padding and / or mode for sync.
  • Refactor the async part to use the same as the sync

How

3 new parameters are now available to pass to the createAsyncEncryptor:

cipher: CryptoJSCore.kdf.OpenSSL is implemented with default values
mode: default -> Electronic Codebook block mode (from crypto-js documentation)
padding: default -> PKCS #5/7 padding strategy

If cipher the only true then mode and padding will be set to their default values.

Example

const encryptTransform = createEncryptor({
  secretKey: 'my-secretkey',
  cipher: true
})

Notes

  • Manual backwards step has been made with live version of redux-persist-transform-encrypt of encrypted data with default config
  • No documentation on how to use it, I do not know where and in which form do you want to put it
  • The value number are setted with mathematicals operations like it has been made in the crypto-js library

@maxdeviant
Copy link
Owner

This PR is not compatible with the changes in #47.

Furthermore, I'm currently not inclined to accept any PRs that add a cipher as I don't fully understand the security implications. From the CryptoJS docs:

CryptoJS supports AES-128, AES-192, and AES-256. It will pick the variant by the size of the key you pass in. If you use a passphrase, then it will generate a 256-bit key.

I think that having consumers of redux-persist-transform-encrypt supply a passphrase and then deriving a 256-bit key from that seems like the simplest way, and does not risk someone compromising the security of AES by feeding it a bad key or IV.

@maxdeviant maxdeviant closed this Oct 17, 2020
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants