Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Encrypted Communication via GitHub Using Node.js and SSH Keys

github.com

Post reply on HN
Print view View original

21–30 of 47 posts

Re: Show HN: Encrypted Communication via GitHub Using Node.js and SSH Keys

#21

Post by jlank »

hardwaresofton wrote: post #10

IIRC, asymmetric key encryption is not preferred for large message lengths -- maybe the author could consider embedding an randomly generated AES key, and using that to encrypt the message instead?

I ran into this issue, I couldn't encrypt really large strings so I chunked the plain text. Not sure why that is the case. I would consider doing something like what you suggest, though I'm not sure exactly how I'd implement it. If you're interested in showing me how, I'd love to collaborate on some code with you (start an issue! https://github.com/sadasystems/private-message/issues)

Re: Show HN: Encrypted Communication via GitHub Using Node.js and SSH Keys

#22

Post by jlank »

ryan-c wrote: post #11
tptacek wrote: post #9

Earlier quoted context omitted.

OAEP doesn't allow you to encrypt variable-length data. They may very well be using OAEP, but that's not my point.

It's awful crypto and it made me throw up in my mouth a little bit. They should be using RSA to encrypt a random key then encrypting the rest of the message with some sort of authenticated encryption.

Sorry I made you barf ryan-c. If you have any interest in making this better I'd be willing to convert your constructive criticism into code. Issues are open on GH :)

Re: Show HN: Encrypted Communication via GitHub Using Node.js and SSH Keys

#23

Post by jlank »

garrettr_ wrote: post #8
zrail wrote: post #4

Earlier quoted context omitted.

It doesn't appear to be a new implementation. It looks like it uses Node's crypto lib: https://nodejs.org/api/crypto.html#crypto_crypto_publicencry... Not sure why it says DSA is supported, the crypto library only supports RSA. It uses this library that stitches together a PEM from an ssh public key: https://github.com/dominictarr/ssh-key-to-pem/blob/master/in...

The point is that it's using ECB mode with RSA, which indicates the developer has no real knowledge of crypto and is just blindly using pairs of "encrypt/decrypt" functions from Node's built-in crypto lib (which is essentially a thing wrapper around OpenSSL and thus joins its illustrious legacy of encouraging developers to make catastrophic cryptographic implementation mistakes). In encryptMessage.js, the plaintext i…

I love this comment. Thank you for putting the time in to proposing a more thorough solution. I will take this (and other) comments into consideration, and make some much needed improvements :)

Re: Show HN: Encrypted Communication via GitHub Using Node.js and SSH Keys

#24

Post by jlank »

jlank wrote: post #21
hardwaresofton wrote: post #10

IIRC, asymmetric key encryption is not preferred for large message lengths -- maybe the author could consider embedding an randomly generated AES key, and using that to encrypt the message instead?

I ran into this issue, I couldn't encrypt really large strings so I chunked the plain text. Not sure why that is the case. I would consider doing something like what you suggest, though I'm not sure exactly how I'd implement it. If you're interested in showing me how, I'd love to collaborate on some code with you (start an issue! https://github.com/sadasystems/private-message/issues )

after reading more comments, I now have a better idea of how to achieve this. thanks again!

Re: Show HN: Encrypted Communication via GitHub Using Node.js and SSH Keys

#27

Post by tptacek »

jlank wrote: post #22
ryan-c wrote: post #11

Earlier quoted context omitted.

It's awful crypto and it made me throw up in my mouth a little bit. They should be using RSA to encrypt a random key then encrypting the rest of the message with some sort of authenticated encryption.

Sorry I made you barf ryan-c. If you have any interest in making this better I'd be willing to convert your constructive criticism into code. Issues are open on GH :)

Can you take this as a learning experience?

1. Tools to encrypt messages using Github SSH keys are probably not a good idea. They're no more usable than real message encryption solutions, but have far more constraints.

2. You cannot safely use RSA like a normal cipher. RSA is a tool for building crypto protocols. The way you've deployed it here has a serious vulnerability.

If you want to build things that use cryptography, I think you really need to work with a high-level library. Nacl (or libsodium) is a great example of a package that goes out of its way to bulletproof itself.

Re: Show HN: Encrypted Communication via GitHub Using Node.js and SSH Keys

#28

Post by tptacek »

jlank wrote: post #23
garrettr_ wrote: post #8

Earlier quoted context omitted.

The point is that it's using ECB mode with RSA, which indicates the developer has no real knowledge of crypto and is just blindly using pairs of "encrypt/decrypt" functions from Node's built-in crypto lib (which is essentially a thing wrapper around OpenSSL and thus joins its illustrious legacy of encouraging developers to make catastrophic cryptographic implementation mistakes). In encryptMessage.js, the plaintext i…

I love this comment. Thank you for putting the time in to proposing a more thorough solution. I will take this (and other) comments into consideration, and make some much needed improvements :)

There are a whole bunch of things you're likely to get wrong trying to design your own "hybrid" encryption system. It's not easy. Why not spend some time learning how to break crypto before you start building it?

Re: Show HN: Encrypted Communication via GitHub Using Node.js and SSH Keys

#29

Post by RyanZAG »

tptacek wrote: post #27
jlank wrote: post #22

Earlier quoted context omitted.

Sorry I made you barf ryan-c. If you have any interest in making this better I'd be willing to convert your constructive criticism into code. Issues are open on GH :)

Can you take this as a learning experience? 1. Tools to encrypt messages using Github SSH keys are probably not a good idea. They're no more usable than real message encryption solutions, but have far more constraints. 2. You cannot safely use RSA like a normal cipher. RSA is a tool for building crypto protocols. The way you've deployed it here has a serious vulnerability. If you want to build things that use cryptog…

Agree on higher level libraries being necessary - but Nacl or libsodium? Those are some enormous dependencies you're talking about here.

I'd say we need more effort on small, focus built libraries for tasks such as these. You can talk about how people need to add in Nacl into their project, but actually doing that is simply not possible for many developers.

eg, more libraries like this one: https://github.com/tozny/java-aes-crypto

Re: Show HN: Encrypted Communication via GitHub Using Node.js and SSH Keys

#30

Post by jps359 »

tptacek wrote: post #28
jlank wrote: post #23

Earlier quoted context omitted.

I love this comment. Thank you for putting the time in to proposing a more thorough solution. I will take this (and other) comments into consideration, and make some much needed improvements :)

There are a whole bunch of things you're likely to get wrong trying to design your own "hybrid" encryption system. It's not easy. Why not spend some time learning how to break crypto before you start building it?

Do you have any specific resources that you can recommend for learning to break crypto?
Post reply on HN