search

PaulSec / Social-Markdown

"Dillinger.io clone" allowing live concurrent editing.
MIT License
10 stars 5 forks source link

AES encryption #4

Open Phyks opened 10 years ago

Phyks commented 10 years ago

Hi,

I can't figure out how the AES encryption works. Maybe it could be worth adding some info in the README about this feature ?

Thanks

PaulSec commented 10 years ago

Hi,

I'm using this library: https://code.google.com/p/crypto-js/ for the AES encryption. I'll write some documentation about it.

Paul

Phyks commented 10 years ago

Yes, I know about this library.

On my instance (http://md.phyks.me/) I just have a "decrypt" button, and no encrypt button. I tried to put some previously encrypted AES text, but the decryption did not do anything, so I think I missed something (and I did not yet had time to look into the code).

PaulSec commented 10 years ago

Oh okay, I see what you mean.

The idea is that you create your document, add your AES encryption key and "Save" the document. Then, it's fully encrypted on the server-side.

Then, you just access the same page, enter your AES encryption key and "Decrypt" it.

So basically, "Encrypt" == "Save" and then you have the "Decrypt" action. This can be a bit confusing though.

Phyks commented 10 years ago

Ah ok, I see. It works then ! :) Yes, it's a bit confusing.

Moreover, it could be nice to have a periodic autosave (which apparently does not exist yet) (+ a notification on successful save :).

Phyks commented 10 years ago

Moreover, I discovered that if one do not enter any AES key, the content is still encrypted when clicking "save", with the entered key which happens to be "". There is therefore no way to decrypt the pad without tweaking the interface to show the decrypt button. In such a case, I think the content should be stored in plain text, no ?