sakship31 / Text-steganography

Flask website for implementation of paper on text-based steganography i.e. hiding a secret message in a cover message and sending it over social media which in turn can be revealed.
24 stars 7 forks source link

Cryptographic API Misuse Vulnerability #4

Open lialon opened 2 months ago

lialon commented 2 months ago

Description:

In the "Text-steganography/AES.py", I have identified a security vulnerability about hardcode salt. And do not use hardcode/static salt in the PBKDF, which would make output easy to predict.

Location:

https://github.com/sakship31/Text-steganography/blob/master/AES.py#L8

salt = b"this is a salt"
kdf = PBKDF2(password, salt, 64, 1000)

Reference

Recommendations