Giters

lbryio / lbry-sdk

The LBRY SDK for building decentralized, censorship resistant, monetized, digital content apps.

Home Page:https://lbry.com

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Questions about sha256 and salt used

Gax-c opened this issue · comments

commented

I've got some questions when browsing the source code.

  1. The sha256 here is used to generate the key from secret. But sha256 itself is not a secure algorithm for key derivation. Some other algorithms like PBKDF2 will be better.

  2. Why the salt and IV are the same here, they are supposed to be different to provide security.

I think these two may lead to potential vulnerabilities.