Skip to content

Issue 1112 encrypted exports

Kaplan requested to merge kmk/kresus:issue-1112-encrypted-exports into main

Work on issue #1112.

  • Use a random salt different for each export,
  • the salt is embedded in the export,
  • use HMAC-SHA256 instead of HMAC-SHA512 for PBKDF2's pseudo random function. Even HMAC-SHA1 is considered secure,
  • use AES in GCM mode for its authentication feature,
  • support AES128, AES192 and AES256. But there is no configuration setting (yet?),
  • many cipher parameters are saved along the export.

Note: I am not a Javascript programmer. So do not hesitate to indicate where I am not using the right constructs.

TODO?

  • Save de KDF (PBKDF2) in the export,
  • save the PBKDF2 PRF (HMAC-SHA256) in the export,
  • save the IV size in the export

Merge request reports