search

lbryio / lbry-sdk

The LBRY SDK for building decentralized, censorship resistant, monetized, digital content apps.
https://lbry.com
MIT License
7.2k stars 483 forks source link

Questions about sha256 and salt used #3737

Open Gax-c opened 3 months ago

Gax-c commented 3 months ago

I've got some questions when browsing the source code.

  1. The sha256 here is used to generate the key from secret. But sha256 itself is not a secure algorithm for key derivation. Some other algorithms like PBKDF2 will be better.

  2. Why the salt and IV are the same here, they are supposed to be different to provide security.

I think these two may lead to potential vulnerabilities.