search

DanWin / le-chat-php

A PHP Chat based on LE CHAT
https://danwin1210.de/chat/
GNU General Public License v3.0
268 stars 98 forks source link

Encryption is vulnerable #114

Open cypherbits opened 3 years ago

cypherbits commented 3 years ago

We changed some time ago the message encryption to use the new, safer and faster AES GCM with libsodium.

But we are reusing the IV/Nonce for the same Key. AES GCM is vulnerable in this cases. Nonces should be generated for each new message and stored with the message for decryption (a new DB column).

Exploiting this is not that easy, so we should review our threat model and decide or not to change it or maybe just put a warning on the readme...

ghost commented 3 years ago

Got any references to the lines in the files?

cypherbits commented 3 years ago

@zach83 don't understand your question. Everything we encrypt on this chat is done wrong.

ghost commented 3 years ago

Right, so could you show me where on the file everything is getting encrypted?

DanWin commented 3 years ago

That is correct, thanks for pointing it out. Also the encryption in AES GCM with libsodium is not always available. If I for example enable the encryption on a raspberry pi, it will result in a fatal error, because the CPU doesn't provide hardware accelerated AES, which libsodium considers mandatory for security reasons. (see https://www.php.net/manual/en/function.sodium-crypto-aead-aes256gcm-is-available.php) I'd suggest to switch to the more secure ChaCha20-Poly1305, which is also provided by libsodium and always available. Along with that, we can introduce a per message IV.

cypherbits commented 2 years ago

Should we support both, make a config value? hardware accelerated AES is a lot faster.