{"action":"created","issue":{"url":"https://api.github.com/repos/Joey3000/piwik-LoginEncrypted/issues/5","labels_url":"https://api.github.com/repos/Joey3000/piwik-LoginEncrypted/issues/5/labels{/name}","comments_url":"https://api.github.com/repos/Joey3000/piwik-LoginEncrypted/issues/5/comments","events_url":"https://api.github.com/repos/Joey3000/piwik-LoginEncrypted/issues/5/events","html_url":"https://github.com/Joey3000/piwik-LoginEncrypted/issues/5","id":124654055,"number":5,"title":"Remove payload splitting on encryption","user":{"login":"Joey3000","id":3662335,"avatar_url":"https://avatars.githubusercontent.com/u/3662335?v=3","gravatar_id":"","url":"https://api.github.com/users/Joey3000","html_url":"https://github.com/Joey3000","followers_url":"https://api.github.com/users/Joey3000/followers","following_url":"https://api.github.com/users/Joey3000/following{/other_user}","gists_url":"https://api.github.com/users/Joey3000/gists{/gist_id}","starred_url":"https://api.github.com/users/Joey3000/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Joey3000/subscriptions","organizations_url":"https://api.github.com/users/Joey3000/orgs","repos_url":"https://api.github.com/users/Joey3000/repos","events_url":"https://api.github.com/users/Joey3000/events{/privacy}","received_events_url":"https://api.github.com/users/Joey3000/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/Joey3000/piwik-LoginEncrypted/labels/enhancement","name":"enhancement","color":"84b6eb"}],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2016-01-03T15:41:38Z","updated_at":"2016-01-04T02:05:40Z","closed_at":"2016-01-04T02:05:40Z","body":"Currently, the encryption payload is split as described in https://github.com/Joey3000/piwik-LoginEncrypted/blob/1.1.0/LIBRARIES.md#jsbn.\r\n\r\nCiting https://paragonie.com/blog/2015/11/choosing-right-cryptography-library-for-your-php-project-guide:\r\n> The naive solution is to break your input string into chunks then encrypt each one individually. Unfortunately, this is very similar to [the dreaded ECB mode](https://filippo.io/the-ecb-penguin). Also: It would be terribly slow. This is a bad idea.\r\n\r\nFollowing needs to be done:\r\n* Remove the above mentioned payload splitting.\r\n* Update for encryption of the entire payload size:\r\n  * Either increase the key size to be large enough for the entire payload (see the links in https://github.com/Joey3000/piwik-LoginEncrypted/issues/2 for needed size)\r\n  * Or implement a hybrid encryption: AES for payload encryption and RSA for encryption of the AES key (see the links in https://github.com/Joey3000/piwik-LoginEncrypted/issues/2, as well as \"Easy RSA\" in the above paragonie.com link, for implementation examples)"},"comment":{"url":"https://api.github.com/repos/Joey3000/piwik-LoginEncrypted/issues/comments/168565408","html_url":"https://github.com/Joey3000/piwik-LoginEncrypted/issues/5#issuecomment-168565408","issue_url":"https://api.github.com/repos/Joey3000/piwik-LoginEncrypted/issues/5","id":168565408,"user":{"login":"Joey3000","id":3662335,"avatar_url":"https://avatars.githubusercontent.com/u/3662335?v=3","gravatar_id":"","url":"https://api.github.com/users/Joey3000","html_url":"https://github.com/Joey3000","followers_url":"https://api.github.com/users/Joey3000/followers","following_url":"https://api.github.com/users/Joey3000/following{/other_user}","gists_url":"https://api.github.com/users/Joey3000/gists{/gist_id}","starred_url":"https://api.github.com/users/Joey3000/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Joey3000/subscriptions","organizations_url":"https://api.github.com/users/Joey3000/orgs","repos_url":"https://api.github.com/users/Joey3000/repos","events_url":"https://api.github.com/users/Joey3000/events{/privacy}","received_events_url":"https://api.github.com/users/Joey3000/received_events","type":"User","site_admin":false},"created_at":"2016-01-04T02:05:40Z","updated_at":"2016-01-04T02:05:40Z","body":"That is not really needed, because the above quote does not really apply. I.e.:\r\n\r\n> The naive solution is to break your input string into chunks then encrypt each one individually. Unfortunately, this is very similar to [the dreaded ECB mode](https://filippo.io/the-ecb-penguin).\r\n\r\nIt's not really similar, if secure PKCS#1 padding is used. Because in case of the RSA, each block is an independent encryption step, each utilizing new random padding. So, even if each of the chunks were to contain the same plain text, the encryption output of the chunks would be completely and unguessably different. I.e., not showing any pattern like in the case of the ECB mode.\r\n\r\n> Also: It would be terribly slow.\r\n\r\nWell, I'm only encrypting a password, not some long texts. And the password is in the similar length range as the otherwise needed AES key (and often even shorter). So, often a speed gain, actually.\r\n\r\nOn the other hand, using an additional cryptosystem brings additional failure and vulnerability risk. Due to possible implementation or cryptographic errors. So, it rather decreases security than increases it.\r\n\r\nSo, better possibly a bit slower (in case of unlikely long passwords filling, e.g., more than one chunk), but more secure. And given that it's the year 2016, the time difference should not be a problem even with mobile browsers (according to my tests). While the RSA key length would need to be the same for both, the plain-text password and the AES key."}}