News for hackers. Stuff that matters.

A comment on Steel – Open-source command-line password manager. Parent comment

Re:Steel – Open-source command-line password manager by ludbb on Monday October 19, 2015 @02:00AM (#10411352)
While using AES-256-CFB is not "rolling their own crypto", Steel has some other functionality around (see https://gitlab.com/Rosvall/steel/blob/master/crypto.c) which provides bad implementations, namely generate_pass which seeds from timestamp and verify_hmac which is not a constant time comparison function.
[ Parent | on HN ]
Re:Steel – Open-source command-line password manager by stouset on Monday October 19, 2015 @06:02AM (#10411996)
Yes, it absolutely is[0] for essentially the exact examples you cite.

[0]: http://www.cs.berkeley.edu/~daw/teaching/cs261-f12/misc/if.h...).

[ Parent | on HN ]