[PR #832] [MERGED] Fix Encryption scheme #1765

New issue

Closed

opened 2026-02-25 23:30:46 +03:00 by kerem · 0 comments

kerem commented

2026-02-25 23:30:46 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/floccusaddon/floccus/pull/832
Author: @marcelklehr
Created: 2/12/2021
Status: ✅ Merged
Merged: 2/14/2021
Merged by: @marcelklehr

Base: develop ← Head: fix/crypto

📝 Commits (2)

640bfd9 Implement new Crypto module and test it
9dad1e1 Upgrade to new crypto module

📊 Changes

7 files changed (+175 additions, -25 deletions)

View changed files

📝 manifest.json (+1 -1)
📝 package.json (+1 -1)
📝 src/lib/AccountStorage.js (+10 -4)
📝 src/lib/Controller.js (+45 -19)
➕ src/lib/Crypto.ts (+91 -0)
📝 src/lib/DefunctCrypto.js (+0 -0)
📝 src/test/test.js (+27 -0)

📄 Description

The existing encryption implementation (currently only used for securing your credentials residing in your browser storage), while not strictly broken, was built in a somewhat uneducated fashion. My intention with this PR is to change that.

Here is a list of changes:

I've switched to AES in Galois/Counter Mode, which has the benefit of also authenticating the message being encrypted.
The module now always uses a random initialization vector and stores it along with the ciphertext.
Most importantly the module now makes use of the PBKDF2 key derivation algorithm with 250000 iterations and a salt to make it harder to brute-force the pass phrase.

The changes are transparent to the user: Upon installing and unlocking the new version floccus will automatically decrypt all data with the old implementation and re-encrypt it with the new implementation.

Additionally, this will pave the way for #224

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/floccusaddon/floccus/pull/832 **Author:** [@marcelklehr](https://github.com/marcelklehr) **Created:** 2/12/2021 **Status:** ✅ Merged **Merged:** 2/14/2021 **Merged by:** [@marcelklehr](https://github.com/marcelklehr) **Base:** `develop` ← **Head:** `fix/crypto` --- ### 📝 Commits (2) - [`640bfd9`](https://github.com/floccusaddon/floccus/commit/640bfd9a26cfb85ea794141df5c2e61992e72582) Implement new Crypto module and test it - [`9dad1e1`](https://github.com/floccusaddon/floccus/commit/9dad1e1eed0571658a14ad909e74122920525c15) Upgrade to new crypto module ### 📊 Changes **7 files changed** (+175 additions, -25 deletions) <details> <summary>View changed files</summary> 📝 `manifest.json` (+1 -1) 📝 `package.json` (+1 -1) 📝 `src/lib/AccountStorage.js` (+10 -4) 📝 `src/lib/Controller.js` (+45 -19) ➕ `src/lib/Crypto.ts` (+91 -0) 📝 `src/lib/DefunctCrypto.js` (+0 -0) 📝 `src/test/test.js` (+27 -0) </details> ### 📄 Description The existing encryption implementation (currently only used for securing your credentials residing in your browser storage), while not strictly broken, was built in a somewhat uneducated fashion. My intention with this PR is to change that. Here is a list of changes: 1. I've switched to AES in Galois/Counter Mode, which has the benefit of also authenticating the message being encrypted. 2. The module now always uses a random initialization vector and stores it along with the ciphertext. 3. Most importantly the module now makes use of the PBKDF2 key derivation algorithm with 250000 iterations and a salt to make it harder to brute-force the pass phrase. The changes are transparent to the user: Upon installing and unlocking the new version floccus will automatically decrypt all data with the old implementation and re-encrypt it with the new implementation. Additionally, this will pave the way for #224 --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

kerem

2026-02-25 23:30:46 +03:00

closed this issue
added the
pull-request
label

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

starred/floccus#1765

No description provided.

Rows
Columns