Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: improve password encryption methods #675

Merged

Conversation

jinoosss
Copy link
Member

What type of PR is this?

  • feature

What this PR does:

  • Removed Static Key Usage:
    • Eliminated the use of a hardcoded static encryption key (ENCRYPT_CIPHER_KEY), reducing the risk of key leakage or unauthorized access.
  • Implemented AES-GCM:
    • Transitioned from AES-CBC (CryptoJS) to AES-GCM using Web Crypto API, which provides built-in integrity verification through authentication tags.
  • Introduced Initialization Vector (IV):
    • Added a dynamically generated IV (crypto.getRandomValues) to ensure that identical inputs produce different encrypted outputs.
  • In-Memory Key Management:
    • Encryption keys are now stored only in memory using CryptoKey, ensuring they are not persisted in session or local storage.

@jinoosss jinoosss requested a review from a team as a code owner January 28, 2025 10:23
@jinoosss jinoosss force-pushed the ADN-665-hal-007-critical-reuse-of-static-encryption-key branch from 672e91c to 5a20b39 Compare January 29, 2025 01:39
@jinoosss jinoosss merged commit a7b735c into main Jan 30, 2025
2 checks passed
@jinoosss jinoosss deleted the ADN-665-hal-007-critical-reuse-of-static-encryption-key branch January 30, 2025 07:42
@dongwon8247 dongwon8247 mentioned this pull request Jan 30, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants