Missing AES-GCM Authentication Tag Validation and Improper Deprecation Handling
密码学缺陷 / Missing Required Cryptographic Step / #3463949
该报告还没有中文解读。
原文摘录
摘自原文(4981 字符中的一小部分)
**Summary:** In Node.js' crypto module, the `createDecipheriv` states that "the `authTagLength` option defaults to 16 bytes and must be set to a different value if a different length is used." …
原文中的代码
const {
createCipheriv,
createDecipheriv
} = require('crypto');
const key = 'key0123456789key';
const nonce = '123456789012';
var algo = 'aes-128-gcm';
const cipher = createCipheriv(algo, key, nonce);
const plaintext = 'This is some plaintext';
const ciphertext = cipher.update(plaintext, …默认不展示报告全文。以上为简短摘录,完整复现过程请阅读原文。版权归研究员与 Node.js 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @sideni · 版权归作者与 Node.js 所有