Skip to content

bfs_encrypt is unsafe #12

@christoph-morrison

Description

@christoph-morrison

bfs_encrypt just XORs the given password char for char with the corresponding char from the FHEM unique id (like 2a95084455f63205c3be85e728760f55). But the FHEM unique id is not a secret and accessible to everybody on a host (644 for FHEM/FhemUtils/uniqueID which contains the unique id also). XOR is only a sufficient encryption algorithm for one time pads, which the unique is most definitely not.

Metadata

Metadata

Assignees

No one assigned

    Labels

    enhancementNew feature or requesthelp wantedExtra attention is needed

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions