search

immesys / wave

Wide Area Verified Exchange - version 3
MIT License
34 stars 15 forks source link

Initialize crypto params when unmarshalling #19

Closed samkumar closed 5 years ago

samkumar commented 5 years ago

This fixes a crypto vulnerability that causes the "Params" structures in LQ-IBE and WKD-IBE to remain uninitialized when unmarshalled. They are full of "zero memory" (as in a new Go object) which causes crypto operations to fail silently. This PR initializes the params when they are unmarshalled.

Thanks to @ddreyer for noticing that the symmetric key generated by LQ-IBE is the same for each ID, which led me to find this.