Skip to content
Permalink

Comparing changes

Choose two branches to see what’s changed or to start a new pull request. If you need to, you can also or learn more about diff comparisons.

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also . Learn more about diff comparisons here.
base repository: entronad/crypto-es
Failed to load repositories. Confirm that selected base ref is valid, then try again.
Loading
base: v2.0.4
Choose a base ref
...
head repository: entronad/crypto-es
Failed to load repositories. Confirm that selected head ref is valid, then try again.
Loading
compare: master
Choose a head ref
  • 4 commits
  • 6 files changed
  • 2 contributors

Commits on Jul 25, 2023

  1. fix changelog

    @entronad
    entronad committed Jul 25, 2023
    Copy the full SHA
    005c6b1 View commit details

Commits on Oct 19, 2023

  1. Bump @babel/traverse from 7.22.5 to 7.23.2 (#40) 

    Bumps [@babel/traverse](https://github.com/babel/babel/tree/HEAD/packages/babel-traverse) from 7.22.5 to 7.23.2.
- [Release notes](https://github.com/babel/babel/releases)
- [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md)
- [Commits](https://github.com/babel/babel/commits/v7.23.2/packages/babel-traverse)

---
updated-dependencies:
- dependency-name: "@babel/traverse"
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
    @dependabot
    dependabot[bot] authored Oct 19, 2023

    Verified

    This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
    GPG key ID: 4AEE18F83AFDEB23
    Expired
    Verified
    Learn about vigilant mode
    Copy the full SHA
    aa48d48 View commit details

Commits on Oct 24, 2023

  1. v2.1.0

    @entronad
    entronad committed Oct 24, 2023
    Copy the full SHA
    d506677 View commit details

Commits on Jun 18, 2024

  1. Bump braces from 3.0.2 to 3.0.3 (#48) 

    Bumps [braces](https://github.com/micromatch/braces) from 3.0.2 to 3.0.3.
- [Changelog](https://github.com/micromatch/braces/blob/master/CHANGELOG.md)
- [Commits](micromatch/braces@3.0.2...3.0.3)

---
updated-dependencies:
- dependency-name: braces
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
    @dependabot
    dependabot[bot] authored Jun 18, 2024

    Verified

    This commit was created on GitHub.com and signed with GitHub’s verified signature.
    GPG key ID: B5690EEEBB952194
    Verified
    Learn about vigilant mode
    Copy the full SHA
    8c35708 View commit details
Showing with 286 additions and 142 deletions.
  1. +7 −1 CHANGELOG.md
  2. +9 −4 __tests__/debug.js
  3. +14 −14 __tests__/pbkdf2.test.ts
  4. +8 −5 lib/pbkdf2.js
  5. +247 −117 package-lock.json
  6. +1 −1 package.json
8 changes: 7 additions & 1 deletion CHANGELOG.md
View file
Original file line number Diff line number Diff line change
@@ -1,8 +1,14 @@
## 2.1.0

**2023-10-24**

- Change pbkdf2 default params to enhance security: https://github.com/entronad/crypto-es/security/advisories/GHSA-mpj8-q39x-wq5h

## 2.0.4

**2023-07-25**

- Declare no side efects for tree shaking: https://github.com/entronad/crypto-es/pull/37
- Declare no side effects for tree shaking: https://github.com/entronad/crypto-es/pull/37

## 2.0.3

13 changes: 9 additions & 4 deletions __tests__/debug.js
View file
Original file line number Diff line number Diff line change
@@ -1,6 +1,11 @@
import C from '../lib/index.js';

const data = {};
data.saltA = C.enc.Hex.parse('AA00000000000000');
const encryptedA = C.Blowfish.encrypt('Test', 'pass', { salt: data.saltA, hasher: C.algo.SHA256 }).toString();
console.log(encryptedA);
// const data = {};
// data.saltA = C.enc.Hex.parse('AA00000000000000');
// const encryptedA = C.Blowfish.encrypt('Test', 'pass', { salt: data.saltA, hasher: C.algo.SHA256 }).toString();
// console.log(encryptedA);

const start = (new Date()).getTime();
console.log(C.PBKDF2('password', 'ATHENA.MIT.EDUraeburn', { keySize: 128 / 32}).toString());
const end = (new Date()).getTime();
console.log(end - start);
28 changes: 14 additions & 14 deletions __tests__/pbkdf2.test.ts
View file
Original file line number Diff line number Diff line change
@@ -4,72 +4,72 @@ import C from '../lib/index.js';
describe('pbkdf2', () => {
it('keySize 128', () => {
expect(C.PBKDF2('password', 'ATHENA.MIT.EDUraeburn', { keySize: 128 / 32 }).toString())
.toBe('cdedb5281bb2f801565a1122b2563515');
.toBe('62929ab995a1111c75c37bc562261ea3');
});

it('keySize 256', () => {
expect(C.PBKDF2('password', 'ATHENA.MIT.EDUraeburn', { keySize: 256 / 32 }).toString())
.toBe('cdedb5281bb2f801565a1122b25635150ad1f7a04bb9f3a333ecc0e2e1f70837');
.toBe('62929ab995a1111c75c37bc562261ea3fb3cdc7e725c4ca87c03cec5bb7663e1');
});

it('keySize 128 iterations 2', () => {
expect(C.PBKDF2('password', 'ATHENA.MIT.EDUraeburn', { keySize: 128 / 32, iterations: 2 }).toString())
.toBe('01dbee7f4a9e243e988b62c73cda935d');
.toBe('262fb72ea65b44ab5ceba7f8c8bfa781');
});

it('keySize 256 iterations 2', () => {
expect(C.PBKDF2('password', 'ATHENA.MIT.EDUraeburn', { keySize: 256 / 32, iterations: 2 }).toString())
.toBe('01dbee7f4a9e243e988b62c73cda935da05378b93244ec8f48a99e61ad799d86');
.toBe('262fb72ea65b44ab5ceba7f8c8bfa7815ff9939204eb7357a59a75877d745777');
});

it('keySize 128 iterations 1200', () => {
expect(C.PBKDF2('password', 'ATHENA.MIT.EDUraeburn', { keySize: 128 / 32, iterations: 1200 }).toString())
.toBe('5c08eb61fdf71e4e4ec3cf6ba1f5512b');
.toBe('c76a982415f1acc71dc197273c5b6ada');
});

it('keySize 256 iterations 1200', () => {
expect(C.PBKDF2('password', 'ATHENA.MIT.EDUraeburn', { keySize: 256 / 32, iterations: 1200 }).toString())
.toBe('5c08eb61fdf71e4e4ec3cf6ba1f5512ba7e52ddbc5e5142f708a31e2e62b1e13');
.toBe('c76a982415f1acc71dc197273c5b6ada32f62915ed461718aad32843762433fa');
});

it('keySize 128 iterations 5', () => {
expect(C.PBKDF2('password', C.enc.Hex.parse('1234567878563412'), { keySize: 128 / 32, iterations: 5 }).toString())
.toBe('d1daa78615f287e6a1c8b120d7062a49');
.toBe('74e98b2e9eeddaab3113c1efc6d82b07');
});

it('keySize 256 iterations 5', () => {
expect(C.PBKDF2('password', C.enc.Hex.parse('1234567878563412'), { keySize: 256 / 32, iterations: 5 }).toString())
.toBe('d1daa78615f287e6a1c8b120d7062a493f98d203e6be49a6adf4fa574b6e64ee');
.toBe('74e98b2e9eeddaab3113c1efc6d82b073c4860195b3e0737fa21a4778f376321');
});

it('keySize 128 iterations 1200 pass phrase equals block size', () => {
expect(C.PBKDF2('XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX', 'pass phrase equals block size', { keySize: 128 / 32, iterations: 1200 }).toString())
.toBe('139c30c0966bc32ba55fdbf212530ac9');
.toBe('c1dfb29a4d2f2fb67c6f78d074d66367');
});

it('keySize 256 iterations 1200 pass phrase equals block size', () => {
expect(C.PBKDF2('XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX', 'pass phrase equals block size', { keySize: 256 / 32, iterations: 1200 }).toString())
.toBe('139c30c0966bc32ba55fdbf212530ac9c5ec59f1a452f5cc9ad940fea0598ed1');
.toBe('c1dfb29a4d2f2fb67c6f78d074d663671e6fd4da1e598572b1fecf256cb7cf61');
});

it('keySize 128 iterations 1200 pass phrase exceeds block size', () => {
expect(C.PBKDF2('XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX', 'pass phrase exceeds block size', { keySize: 128 / 32, iterations: 1200 }).toString())
.toBe('9ccad6d468770cd51b10e6a68721be61');
.toBe('22344bc4b6e32675a8090f3ea80be01d');
});

it('keySize 256 iterations 1200 pass phrase exceeds block size', () => {
expect(C.PBKDF2('XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX', 'pass phrase exceeds block size', { keySize: 256 / 32, iterations: 1200 }).toString())
.toBe('9ccad6d468770cd51b10e6a68721be611a8b4d282601db3b36be9246915ec82a');
.toBe('22344bc4b6e32675a8090f3ea80be01d5f95126a2cddc3facc4a5e6dca04ec58');
});

it('keySize 128 iterations 50', () => {
expect(C.PBKDF2(C.enc.Hex.parse('f09d849e'), 'EXAMPLE.COMpianist', { keySize: 128 / 32, iterations: 50 }).toString())
.toBe('6b9cf26d45455a43a5b8bb276a403b39');
.toBe('44b0781253db3141ac4174af29325818');
});

it('keySize 256 iterations 50', () => {
expect(C.PBKDF2(C.enc.Hex.parse('f09d849e'), 'EXAMPLE.COMpianist', { keySize: 256 / 32, iterations: 50 }).toString())
.toBe('6b9cf26d45455a43a5b8bb276a403b39e7fe37a0c41e02c281ff3069e1e94f52');
.toBe('44b0781253db3141ac4174af29325818584698d507a79f9879033dec308a2b77');
});

it('input integrity', () => {
13 changes: 8 additions & 5 deletions lib/pbkdf2.js
View file
Original file line number Diff line number Diff line change
@@ -2,7 +2,7 @@ import {
Base,
WordArray,
} from './core.js';
import { SHA1Algo } from './sha1.js';
import { SHA256Algo } from './sha256.js';
import { HMAC } from './hmac.js';

/**
@@ -25,17 +25,20 @@ export class PBKDF2Algo extends Base {

/**
* Configuration options.
*
* The default `hasher` and `interations` is different from CryptoJs to enhance security:
* https://github.com/entronad/crypto-es/security/advisories/GHSA-mpj8-q39x-wq5h
*
* @property {number} keySize The key size in words to generate. Default: 4 (128 bits)
* @property {Hasher} hasher The hasher to use. Default: SHA1
* @property {number} iterations The number of iterations to perform. Default: 1
* @property {Hasher} hasher The hasher to use. Default: SHA256
* @property {number} iterations The number of iterations to perform. Default: 250000
*/
this.cfg = Object.assign(
new Base(),
{
keySize: 128 / 32,
hasher: SHA1Algo,
iterations: 1,
hasher: SHA256Algo,
iterations: 250000,
},
cfg,
);
Loading