search

subrosa-io / subrosa-client

Secure, end to end encrypted messaging, voice and video chats.
https://subrosa.io
Other
106 stars 34 forks source link

Inaccurate wording and insufficient documentation #34

Closed joepie91 closed 10 years ago

joepie91 commented 10 years ago

The Security page refers to PBKDF as 'encryption', while it absolutely isn't that, since the process is not reversible. PBKDF is a key derivation function - not only is it essential to correctly understand and publish this (there's really no margin for misunderstandings in security and cryptography), the used (hash) function should also be explicitly specified (eg. HMAC-SHA1 or whatever it is that Subrosa uses).

ixro commented 10 years ago

Hi, We understand PBKDF is for key derivation, not encryption. Subrosa uses PBKDF (HMAC-SHA1) to derive a key for AES-CBC-256, which is the encryption referring to.

Thanks for pointing this out, and the security contact email. We've overhauled the security page: http://subrosa.io/security