Skip to content

Commit 9d24c7a

Browse files
tniessenjuanarbol
authored andcommitted
doc: emphasize that createCipher is never secure
The current documentation clearly states that createCipher() and createDecipher() should not be used with ciphers in counter mode, but (1) this is an understatement, and (2) these functions are (semantically) insecure for ciphers in any other supported block cipher mode as well. Semantic security requires IND-CPA, but a deterministic cipher with fixed key and IV, such as those generated by these functions, does not fulfill IND-CPA. Are there justified use cases for createCipher() and createDecipher()? Yes and no. The only case in which these functions can be used in a semantically secure manner arises only when the password argument is not actually a password but rather a random or pseudo-random sequence that is unpredictable and that is never reused (e.g., securely derived from a password with a proper salt). Insofar, it is possible to use these APIs without immediately creating a vulnerability. However, - any application that manages to fulfill this requirement should also be able to fulfill the similar requirements of crypto.createCipheriv() and those of crypto.createDecipheriv(), which give much more control over key and initialization vector, and - the MD5-based key derivation step generally does not help and might even reduce the overall security due to its many weaknesses. Refs: #13821 Refs: #19343 Refs: #22089 PR-URL: #44538 Reviewed-By: Anna Henningsen <[email protected]> Reviewed-By: Rich Trott <[email protected]> Reviewed-By: Mohammed Keyvanzadeh <[email protected]> Reviewed-By: Filip Skokan <[email protected]>
1 parent 602ecaa commit 9d24c7a

File tree

2 files changed

+10
-2
lines changed

2 files changed

+10
-2
lines changed

doc/api/crypto.md

+8
Original file line numberDiff line numberDiff line change
@@ -2987,6 +2987,10 @@ The `password` is used to derive the cipher key and initialization vector (IV).
29872987
The value must be either a `'latin1'` encoded string, a [`Buffer`][], a
29882988
`TypedArray`, or a `DataView`.
29892989

2990+
<strong class="critical">This function is semantically insecure for all
2991+
supported ciphers and fatally flawed for ciphers in counter mode (such as CTR,
2992+
GCM, or CCM).</strong>
2993+
29902994
The implementation of `crypto.createCipher()` derives keys using the OpenSSL
29912995
function [`EVP_BytesToKey`][] with the digest algorithm set to MD5, one
29922996
iteration, and no salt. The lack of salt allows dictionary attacks as the same
@@ -3106,6 +3110,10 @@ cipher in CCM or OCB mode (e.g. `'aes-128-ccm'`) is used. In that case, the
31063110
authentication tag in bytes, see [CCM mode][].
31073111
For `chacha20-poly1305`, the `authTagLength` option defaults to 16 bytes.
31083112

3113+
<strong class="critical">This function is semantically insecure for all
3114+
supported ciphers and fatally flawed for ciphers in counter mode (such as CTR,
3115+
GCM, or CCM).</strong>
3116+
31093117
The implementation of `crypto.createDecipher()` derives keys using the OpenSSL
31103118
function [`EVP_BytesToKey`][] with the digest algorithm set to MD5, one
31113119
iteration, and no salt. The lack of salt allows dictionary attacks as the same

doc/api/deprecations.md

+2-2
Original file line numberDiff line numberDiff line change
@@ -2121,10 +2121,10 @@ changes:
21212121

21222122
Type: Runtime
21232123

2124-
Using [`crypto.createCipher()`][] and [`crypto.createDecipher()`][] should be
2124+
Using [`crypto.createCipher()`][] and [`crypto.createDecipher()`][] must be
21252125
avoided as they use a weak key derivation function (MD5 with no salt) and static
21262126
initialization vectors. It is recommended to derive a key using
2127-
[`crypto.pbkdf2()`][] or [`crypto.scrypt()`][] and to use
2127+
[`crypto.pbkdf2()`][] or [`crypto.scrypt()`][] with random salts and to use
21282128
[`crypto.createCipheriv()`][] and [`crypto.createDecipheriv()`][] to obtain the
21292129
[`Cipher`][] and [`Decipher`][] objects respectively.
21302130

0 commit comments

Comments
 (0)