search

scumjr / yubikeyedup

Simple and secure YubiKey OTP validation server
GNU General Public License v3.0
34 stars 15 forks source link

Port to cryptography #4

Closed tdsmith closed 7 years ago

tdsmith commented 7 years ago

Use cryptography instead of pycrypto since pycrypto is no longer maintained; i.e. it hasn't seen a release since 2013 or a commit to master since 2014.

pycrypto still works but there's at least one buffer overflow that doesn't have a fix in a released version -- https://github.com/dlitz/pycrypto/issues/176 -- though yubikeyedup isn't affected by it.

scumjr commented 7 years ago

Indeed, python-crypto is no longer maintained but it's only used to decrypt a buffer with AES-ECB. Regarding security, the size of the buffer passed to AES.decrypt is fixed so a vulnerability is highly unlikely.

I don't think that it justifies the use of python-cryptography.