Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Use a random IV #12

Open
capybit opened this issue Nov 20, 2024 · 0 comments
Open

Use a random IV #12

capybit opened this issue Nov 20, 2024 · 0 comments

Comments

@capybit
Copy link

capybit commented Nov 20, 2024

Thank you for your library—it has definitely helped me see the light at the end of the tunnel.

After some research, I found that the initialization vector (IV) should always be randomly generated for each encryption operation to ensure robust security. Using a static IV can lead to vulnerabilities, as it compromises the cryptographic principle of uniqueness for each encryption. https://stackered.com/blog/iv-mishandling/

A potential solution could be to randomly generate the IV for each encryption and prepend it to the ciphertext. A custom database function could then extract the IV from the database column and use it to decrypt the remaining ciphertext.

Is there a chance that such an adjustment could be implemented in the near future? Alternatively, would it be possible to use the pgp_sym_decrypt database function along with a compatible C# implementation to handle encryption and decryption?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant