New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

AES key should be encrypted before exchange #378

Open

muke1908 opened this issue Sep 19, 2024 · 0 comments

Labels

Backend bug medium

Owner

muke1908 commented Sep 19, 2024

chat-e2ee/service/src/sdk.ts

Line 148 in 905c8c0

    
           await sharePublicKey({ aesKey: aesPlain, publicKey: this.publicKey, sender: this.userId, channelId: this.channelId});

Right now AES encryption key is sent to server for exchange which is a vulnerability. It should be send via end-to-end encrypted channel.

muke1908 added bug medium Backend labels

R00tedbrain mentioned this issue

Full bugs extracted R00tedbrain/chat-e2eeBWT#1

Closed

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment