Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

evp: simplify overall logic #12

Merged
merged 7 commits into from
May 21, 2015
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
68 changes: 32 additions & 36 deletions EVP_BytesToKey.js
Original file line number Diff line number Diff line change
@@ -1,39 +1,35 @@
var createHash = require('create-hash');
module.exports = function evp(password, salt, keyLen) {
keyLen = keyLen/8;
var ki = 0;
var ii = 0;
var key = new Buffer(keyLen);
var addmd = 0;
var md, md_buf;
var i;
while (true) {
md = createHash('md5');
if(addmd++ > 0) {
md.update(md_buf);
var createHash = require('create-hash')

module.exports = function evp (password, salt, keyLen) {
keyLen = keyLen / 8

var offset = 0
var key = new Buffer(keyLen)
var buffer

while (keyLen > 0) {
var hash = createHash('md5')

if (buffer) {
hash.update(buffer)
}
md.update(password);
md.update(salt);
md_buf = md.digest();
i = 0;
if(keyLen > 0) {
while(true) {
if(keyLen === 0) {
break;
}
if(i === md_buf.length) {
break;
}
key[ki++] = md_buf[i++];
keyLen--;
}

hash.update(password)
hash.update(salt)
buffer = hash.digest()

for (var i = 0; i < buffer.length; ++i) {
if (keyLen === 0) break

key[offset] = buffer[i]

keyLen--
offset++
}
if(keyLen === 0) {
break;
}
}
for(i=0;i<md_buf.length;i++) {
md_buf[i] = 0;
}
return key;
};

// zero the temporary buffer
buffer.fill(0)
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I understand the reasoning for this, but can we even make the guarantee that the key won't be around in some other buffer?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This doesn't make us less secure and hopefully at least lowers the number of places in memory the key sits and makes it less likely for somebody to recover it

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sure, I'm just trying to ensure we don't give off any false assertions, this could very easily still be in memory.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yeah we could leave a comment

On Wed, May 20, 2015 at 9:59 AM Daniel Cousens notifications@github.com
wrote:

In EVP_BytesToKey.js
#12 (comment)
:

\ No newline at end of file
+

  • // zero the temporary buffer
  • buffer.fill(0)

Sure, I'm just trying to ensure we don't give off any false assertions,
this could very much still be in memory.


Reply to this email directly or view it on GitHub
https://github.com/crypto-browserify/parse-asn1/pull/12/files#r30703967.


return key
}