News for hackers. Stuff that matters.

A comment on Backdoor in event-stream library dependency. Parent comment

Re:Backdoor in event-stream library dependency by luizfzs on Monday November 26, 2018 @12:06PM (#18534790)
I'm not a crypto guy but this change really makes me scratch my head: https://github.com/right9ctrl/node-scrypt/commit/52a1cb792bc...
[ Parent | on HN ]
Re:Backdoor in event-stream library dependency by regularfry on Monday November 26, 2018 @12:29PM (#18535036)
That just looks like a convenience function to me. Rather than passing 1,2,4,8,16 in as the value of N, you pass in 0,1,2,3,4. Has the benefit that it's not possible to pass in a number that's not a power of 2 (which might not be valid, I don't know how scrypt works).
[ Parent | on HN ]
Re:Backdoor in event-stream library dependency by CiPHPerCoder on Monday November 26, 2018 @12:32PM (#18535079)
IIRC scrypt is only defined for powers of 2 for N.
[ Parent | on HN ]
Re:Backdoor in event-stream library dependency by OJFord on Monday November 26, 2018 @12:17PM (#18534911)
Yes, that looks dodgy - a 64-bit 'N' being renamed 'logN', and its value changed to `1` left shifted by its prior self? I think there's a good bet that's just zeroing it out.
[ Parent | on HN ]
Re:Backdoor in event-stream library dependency by XCSme on Monday November 26, 2018 @12:31PM (#18535065)
It's just doing 2^logN...
[ Parent | on HN ]
Re:Backdoor in event-stream library dependency by OJFord on Monday November 26, 2018 @04:48PM (#18537130)
Which ought to be just N - but notice the argument passed in is mysteriously renamed. It may be nothing - I'm not even sure what N is here - I just agree that it looks weird.
[ Parent | on HN ]
Re:Backdoor in event-stream library dependency by jnewell on Monday November 26, 2018 @08:59PM (#18538674)
https://github.com/barrysteyn/node-scrypt/pull/119
[ Parent | on HN ]