{"action":"created","issue":{"url":"https://api.github.com/repos/square/go-jose/issues/200","repository_url":"https://api.github.com/repos/square/go-jose","labels_url":"https://api.github.com/repos/square/go-jose/issues/200/labels{/name}","comments_url":"https://api.github.com/repos/square/go-jose/issues/200/comments","events_url":"https://api.github.com/repos/square/go-jose/issues/200/events","html_url":"https://github.com/square/go-jose/issues/200","id":359951767,"node_id":"MDU6SXNzdWUzNTk5NTE3Njc=","number":200,"title":"Potential jwe key leak with gcm after 2^32 encryptions?","user":{"login":"epelc","id":5204642,"node_id":"MDQ6VXNlcjUyMDQ2NDI=","avatar_url":"https://avatars2.githubusercontent.com/u/5204642?v=4","gravatar_id":"","url":"https://api.github.com/users/epelc","html_url":"https://github.com/epelc","followers_url":"https://api.github.com/users/epelc/followers","following_url":"https://api.github.com/users/epelc/following{/other_user}","gists_url":"https://api.github.com/users/epelc/gists{/gist_id}","starred_url":"https://api.github.com/users/epelc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/epelc/subscriptions","organizations_url":"https://api.github.com/users/epelc/orgs","repos_url":"https://api.github.com/users/epelc/repos","events_url":"https://api.github.com/users/epelc/events{/privacy}","received_events_url":"https://api.github.com/users/epelc/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2018-09-13T15:37:17Z","updated_at":"2018-09-13T18:51:08Z","closed_at":null,"author_association":"NONE","body":"So I've been looking into symmetric encryption lately with aes-gcm and through my reading I found out that GCM leaks your encryption key if you reuse the same nonce to encrypt two pieces of data. In practice you can't use the same key more than 2^32 times before you are at great risk.\r\n\r\nI didn't find any mention of this on the package docs or in the code. You will only be lead down this rabbit hole if you research GCM or read the go gcm docs and find this in the encryption example:\r\n>// Never use more than 2^32 random nonces with a given key because of the risk of a repeat.\r\n\r\nhttps://golang.org/pkg/crypto/cipher/#NewGCM\r\n\r\n\r\nI was wondering if this was considered/known or if there are safe guards against this issue which I've overlooked. My thought is that it's safe if a single user can not get more than 2^32 jwe's out of a server but that is extremely application specific and if you are storing these in a database there is much greater change of hitting that number."},"comment":{"url":"https://api.github.com/repos/square/go-jose/issues/comments/421113158","html_url":"https://github.com/square/go-jose/issues/200#issuecomment-421113158","issue_url":"https://api.github.com/repos/square/go-jose/issues/200","id":421113158,"node_id":"MDEyOklzc3VlQ29tbWVudDQyMTExMzE1OA==","user":{"login":"epelc","id":5204642,"node_id":"MDQ6VXNlcjUyMDQ2NDI=","avatar_url":"https://avatars2.githubusercontent.com/u/5204642?v=4","gravatar_id":"","url":"https://api.github.com/users/epelc","html_url":"https://github.com/epelc","followers_url":"https://api.github.com/users/epelc/followers","following_url":"https://api.github.com/users/epelc/following{/other_user}","gists_url":"https://api.github.com/users/epelc/gists{/gist_id}","starred_url":"https://api.github.com/users/epelc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/epelc/subscriptions","organizations_url":"https://api.github.com/users/epelc/orgs","repos_url":"https://api.github.com/users/epelc/repos","events_url":"https://api.github.com/users/epelc/events{/privacy}","received_events_url":"https://api.github.com/users/epelc/received_events","type":"User","site_admin":false},"created_at":"2018-09-13T18:51:08Z","updated_at":"2018-09-13T18:51:08Z","author_association":"NONE","body":"Thanks Cedric! I agree on the database uses. I’ll have to read up more on\nkey wrapping, it’s new to me.\n\nI was more concerned with the docs but this issue may do. I guess people\nshould look up the algorithms they are using first and it’s unlikely for\nreal use cases to hit this.\n\nOn Thu, Sep 13, 2018 at 14:22 Cedric Staub <notifications@github.com> wrote:\n\n> This is a known limitation of the GCM cipher mode. There are algorithms\n> which provide nonce-reuse resistance but unfortunately GCM isn't one of\n> them. Using a key wrap mode provides some resistance if you're concerned.\n> In a key wrap mode a random CEK (content encryption key) is generated for\n> each payload and that key is then wrapped with the long-lived key.\n>\n> Unfortunately I'm not sure there's much we can do in this library to\n> prevent someone from using their key too often. And in general I don't\n> think this library should be used for general-purpose crypto. If you're\n> storing something in a DB I'd recommend using something like nacl,\n> libsodium or miscreant instead. Using the JOSE message format only really\n> makes sense if you're implementing an existing standard that happens to\n> require the use of this particular format.\n>\n> —\n> You are receiving this because you authored the thread.\n> Reply to this email directly, view it on GitHub\n> <https://github.com/square/go-jose/issues/200#issuecomment-421104316>, or mute\n> the thread\n> <https://github.com/notifications/unsubscribe-auth/AE9qotI_iHCMpeAMhSwMdOUVsw8VMXBSks5uaqJOgaJpZM4WngzM>\n> .\n>\n-- \nBest regards,\nEdward J. Pelc\n*President*\n\n\n\nWebsite: FreightChick.com <https://freightchick.com>\nOffice: (941) 702-4366\nCell: (941) 735-4047\n"}}
{"actor":{"display_login":"epelc"}}