[security] Replace crypto-es with latest crypto-js v4.2.0 #244
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
sirtimid
changed the title
sirtimid
changed the title
|
Can you check @Adamj1232 @aaronbarnardsound? |
|
@sirtimid we are not using |
|
This is probably regarding this GH (dependabot) advisory: GHSA-mpj8-q39x-wq5h It's nice to know that the package isn't using the vulnerable function, but it would be even better to not have this critical dependabot warning ✌️ |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
This update addresses a crucial security concern in the hashing strategy by altering the default hash algorithm and iterations for PBKDF2. The previous configuration, which relied on the defaults provided by crypto-es, posed potential security weaknesses due to less robust defaults.
Key Changes:
Switched to crypto-js: We have transitioned from using crypto-es to crypto-js. This decision was driven by the wider adoption and community support for crypto-js. Its extensive use in the industry makes it a more reliable choice for our cryptographic operations.
More info:
PBKDF2 is a key-derivation function that is used for two main purposes: (1) to stretch or squash a variable length password's entropy into a fixed size for consumption by another cryptographic operation and (2) to reduce the chance of downstream operations recovering the password input (for example, for password storage).
Unlike the modern webcrypto standard, crypto-js does not throw an error when a number of iterations is not specified, and defaults to one single iteration. In the year 1993, when PBKDF2 was originally specified, the minimum number of iterations suggested was set at 1,000. Today, OWASP recommends 1,300,000
Checklist
package.jsonis incremented following semantic versioning