Llewellyn/Tomb
1
0
Fork 0
mirror of https://github.com/Llewellynvdm/Tomb.git synced 2024-11-10 23:20:57 +00:00
Code Issues Packages Projects Releases Wiki Activity

updated documentation on KDF whitespace bug

Browse Source 
fix #307
This commit is contained in:
Jaromil 2018-09-23 12:05:02 +02:00
parent e8919af867
commit cdd3c5804a
3 changed files with 19 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
AUTHORS.md
View File

@ -27,10 +27,11 @@ The Grugq, Reiven, GDrooid, Alphazo, Brian May, fsLeg, JoelMon,
Narrat, Jerry Polfer, Jim Turner, Maxime Arthaud, RobertMX, Narrat, Jerry Polfer, Jim Turner, Maxime Arthaud, RobertMX,
mhogomchungu Mandeep Bhutani, Emil Lundberg, Joel Montes de Oca, Armin mhogomchungu Mandeep Bhutani, Emil Lundberg, Joel Montes de Oca, Armin
Mesbah, Arusekk, Stephan Schindel, Asbjørn Apeland, Victor Calvert, Mesbah, Arusekk, Stephan Schindel, Asbjørn Apeland, Victor Calvert,
bjonnh, SargoDevel and... the Linux Action Show! bjonnh, SargoDevel, AitorATuin and... the Linux Action Show!
Tomb includes an implementation of the "Password-Based Key Derivation Tomb includes an implementation of the "Password-Based Key Derivation
Function v2" based on GCrypt and written by Anthony Thyssen. Function v2" based on GCrypt and written by Anthony Thyssen, with
fixes contributed by AitorATuin.
Tomb developers can be contacted via GitHub issues on Tomb developers can be contacted via GitHub issues on
https://www.github.com/dyne/Tomb or over IRC https://irc.dyne.org https://www.github.com/dyne/Tomb or over IRC https://irc.dyne.org

15
KNOWN_BUGS.md
View File

@ -1,3 +1,18 @@
# Whitespaces in KDF passwords
## Issue affecting passwords used with PBKDF2 keys (<2.6)
Up until and including Tomb's version 2.5 the PBKDF2 wrapper for keys
in Tomb has a bug affecting passwords that contain whitespaces. Since
the passwords are trimmed at the first whitespace, this makes them
weaker, while fortunately the KDF transformation still applies.
This issue is fixed in Tomb version 2.6: all users adopting KDF keys
that have passwords containing whitespaces should change them,
knowing that their "old password" is trimmed until the whitespace.
Users adopting GPG keys or plain (without KDF wrapper) can ignore
this bug.
# Vulnerability to password bruteforcing # Vulnerability to password bruteforcing
## Issue affecting keys used in steganography ## Issue affecting keys used in steganography

1
extras/kdf-keys/pbkdf2.c
View File

@ -28,6 +28,7 @@
************* *************
** **
** Anthony Thyssen 4 November 2009 A.Thyssen@griffith.edu.au ** Anthony Thyssen 4 November 2009 A.Thyssen@griffith.edu.au
** AitorATuin 3 February 2018 (whitespace password fix in Tomb)
** **
** Based on a test program "pkcs5.c" found on ** Based on a test program "pkcs5.c" found on
** http://www.mail-archive.com/openssl-users@openssl.org ** http://www.mail-archive.com/openssl-users@openssl.org