News for hackers. Stuff that matters.

A comment on Twinkle Notes: Cross-platform encrypted notes app. Parent comment

Re:Twinkle Notes: Cross-platform encrypted notes app by trulyrandom on Wednesday February 05, 2020 @04:34PM (#22251211)
3. They should be authenticated.

To OP, I would suggest using secretstream from libsodium, which abstracts all these problems away for you.

[ Parent | on HN ]
Re:Twinkle Notes: Cross-platform encrypted notes app by CiPHPerCoder on Wednesday February 05, 2020 @04:40PM (#22251252)
> 3. They should be authenticated.

I covered that:

> Furthermore, not authenticating your ciphertext means padding oracle attacks can be launched against the app.

The list above was just the requirements for the initialization vector, not the list of problems with the code.

[ Parent | on HN ]
Re:Twinkle Notes: Cross-platform encrypted notes app by trulyrandom on Thursday February 06, 2020 @02:03PM (#22259119)
Right, but I was specifically talking about authenticating the IV.
[ Parent | on HN ]