godotengine / godot-docs

Godot Engine official documentation
https://docs.godotengine.org
Other
3.94k stars 3.22k forks source link

Warning message when generating an encryption key with openssl V1.1.1 or later #5567

Closed Sauermann closed 2 years ago

Sauermann commented 2 years ago

Your Godot version: 4.0 Alpha

Issue description:

Generating an encryption key with openssl according to the "Compiling with script encryption key" documentation results in a warning message.

user@linux:~$ openssl enc -aes-256-cbc -k secret -P -md sha1
*** WARNING : deprecated key derivation used.
Using -iter or -pbkdf2 would be better.
salt=650FCA822BDC94F5
key=FB20BDC7141D3704499F73098A6270F957AC134FBDA1EA99FEF5B3953EC2DF0B
iv =AE94260B8B4E7FA5B1082740E116CAF1

There is a detailed explanation of this warning message at: https://unix.stackexchange.com/questions/507131/openssl-1-1-1b-warning-using-iter-or-pbkdf2-would-be-better-while-decrypting

I would expect that the suggested method does not result in warning messages.

URL to the documentation page:

https://docs.godotengine.org/en/stable/development/compiling/compiling_with_script_encryption_key.html

Proposed Solution:

I suggest to replace the command by

openssl rand -hex 32 > godot.gdkey

This also is a more appropriate way for generating random data for the encryption key.

If this solution finds acceptance, I can create a pull request for updating the documentation.

Calinou commented 2 years ago

If this solution finds acceptance, I can create a pull request for updating the documentation.

Sounds good to me :slightly_smiling_face:

I've tested this command on Linux (OpenSSL 1.1.1g) and Windows (OpenSSL 3.0.1) and both appear to work fine.