{"action":"opened","number":375,"pull_request":{"url":"https://api.github.com/repos/filesender/filesender/pulls/375","id":201550567,"node_id":"MDExOlB1bGxSZXF1ZXN0MjAxNTUwNTY3","html_url":"https://github.com/filesender/filesender/pull/375","diff_url":"https://github.com/filesender/filesender/pull/375.diff","patch_url":"https://github.com/filesender/filesender/pull/375.patch","issue_url":"https://api.github.com/repos/filesender/filesender/issues/375","number":375,"state":"open","locked":false,"title":"encryption: new Key derivation using importKey then deiveKey","user":{"login":"monkeyiq","id":387108,"node_id":"MDQ6VXNlcjM4NzEwOA==","avatar_url":"https://avatars0.githubusercontent.com/u/387108?v=4","gravatar_id":"","url":"https://api.github.com/users/monkeyiq","html_url":"https://github.com/monkeyiq","followers_url":"https://api.github.com/users/monkeyiq/followers","following_url":"https://api.github.com/users/monkeyiq/following{/other_user}","gists_url":"https://api.github.com/users/monkeyiq/gists{/gist_id}","starred_url":"https://api.github.com/users/monkeyiq/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/monkeyiq/subscriptions","organizations_url":"https://api.github.com/users/monkeyiq/orgs","repos_url":"https://api.github.com/users/monkeyiq/repos","events_url":"https://api.github.com/users/monkeyiq/events{/privacy}","received_events_url":"https://api.github.com/users/monkeyiq/received_events","type":"User","site_admin":false},"body":"This is an update for how an encryption key is created from the given\r\npassword when encrypting or decrypting files. As the manner in which\r\nthe key is created from the password can create different keys from\r\nthe same password this PR also includes versioning for encrypted\r\nfiles. This way, files encrypted with the old key derivation will\r\ncontinue to be decrypted while all new files will switch to the new\r\nkey derivation scheme.\r\n\r\nThis PR moves the code closer in style to the example of the\r\nSubtleCrypto API that is published by mozilla.org at\r\nhttps://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto/deriveKey#Example\r\n\r\nKey type 1 forces the encryption to AES-CBC at 256 bit and the number\r\nof hashing rounds is chosen to be secure through around 2020. This is\r\na trade off where I think the magic numbers will have to be brought\r\nout because there is simply no \"one size fits all\" for the hash\r\niteration count. If a site is dealing with sensitive material it may\r\nneed 10 times the iterations to meet the site policy. I have left this\r\nsetting inline for now.\r\n\r\nThis is to address the original report of the issue in\r\nhttps://github.com/filesender/filesender/issues/338\r\n\r\nNote that the salt is generated server side and sent out to the client\r\nfor both initial encryption and made available for decryption. This\r\ndoes not allow the server any real help in decrypting the data but\r\ndoes make each transfer of the exact same data with the exact same\r\npassword give different results when encrypted. As such it should help\r\nto stifle password hash tables and the like as each individual\r\ntransfer will need to be attacked.\r\n\r\nThe provision of salt moving server to client in the new\r\nencryption_details object paves the way for more information to be\r\nsent over such as file IDs or other data for the transaction that\r\nmight help bind the password to the transfer and improve security.","created_at":"2018-07-16T06:38:38Z","updated_at":"2018-07-16T06:38:38Z","closed_at":null,"merged_at":null,"merge_commit_sha":null,"assignee":null,"assignees":[],"requested_reviewers":[],"requested_teams":[],"labels":[],"milestone":null,"commits_url":"https://api.github.com/repos/filesender/filesender/pulls/375/commits","review_comments_url":"https://api.github.com/repos/filesender/filesender/pulls/375/comments","review_comment_url":"https://api.github.com/repos/filesender/filesender/pulls/comments{/number}","comments_url":"https://api.github.com/repos/filesender/filesender/issues/375/comments","statuses_url":"https://api.github.com/repos/filesender/filesender/statuses/a46a93aaa900a42d270c05a0e6976b22de978dce","head":{"label":"monkeyiq:2018/july/derivekey","ref":"2018/july/derivekey","sha":"a46a93aaa900a42d270c05a0e6976b22de978dce","user":{"login":"monkeyiq","id":387108,"node_id":"MDQ6VXNlcjM4NzEwOA==","avatar_url":"https://avatars0.githubusercontent.com/u/387108?v=4","gravatar_id":"","url":"https://api.github.com/users/monkeyiq","html_url":"https://github.com/monkeyiq","followers_url":"https://api.github.com/users/monkeyiq/followers","following_url":"https://api.github.com/users/monkeyiq/following{/other_user}","gists_url":"https://api.github.com/users/monkeyiq/gists{/gist_id}","starred_url":"https://api.github.com/users/monkeyiq/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/monkeyiq/subscriptions","organizations_url":"https://api.github.com/users/monkeyiq/orgs","repos_url":"https://api.github.com/users/monkeyiq/repos","events_url":"https://api.github.com/users/monkeyiq/events{/privacy}","received_events_url":"https://api.github.com/users/monkeyiq/received_events","type":"User","site_admin":false},"repo":{"id":86575966,"node_id":"MDEwOlJlcG9zaXRvcnk4NjU3NTk2Ng==","name":"filesender","full_name":"monkeyiq/filesender","owner":{"login":"monkeyiq","id":387108,"node_id":"MDQ6VXNlcjM4NzEwOA==","avatar_url":"https://avatars0.githubusercontent.com/u/387108?v=4","gravatar_id":"","url":"https://api.github.com/users/monkeyiq","html_url":"https://github.com/monkeyiq","followers_url":"https://api.github.com/users/monkeyiq/followers","following_url":"https://api.github.com/users/monkeyiq/following{/other_user}","gists_url":"https://api.github.com/users/monkeyiq/gists{/gist_id}","starred_url":"https://api.github.com/users/monkeyiq/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/monkeyiq/subscriptions","organizations_url":"https://api.github.com/users/monkeyiq/orgs","repos_url":"https://api.github.com/users/monkeyiq/repos","events_url":"https://api.github.com/users/monkeyiq/events{/privacy}","received_events_url":"https://api.github.com/users/monkeyiq/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/monkeyiq/filesender","description":"FileSender server software","fork":true,"url":"https://api.github.com/repos/monkeyiq/filesender","forks_url":"https://api.github.com/repos/monkeyiq/filesender/forks","keys_url":"https://api.github.com/repos/monkeyiq/filesender/keys{/key_id}","collaborators_url":"https://api.github.com/repos/monkeyiq/filesender/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/monkeyiq/filesender/teams","hooks_url":"https://api.github.com/repos/monkeyiq/filesender/hooks","issue_events_url":"https://api.github.com/repos/monkeyiq/filesender/issues/events{/number}","events_url":"https://api.github.com/repos/monkeyiq/filesender/events","assignees_url":"https://api.github.com/repos/monkeyiq/filesender/assignees{/user}","branches_url":"https://api.github.com/repos/monkeyiq/filesender/branches{/branch}","tags_url":"https://api.github.com/repos/monkeyiq/filesender/tags","blobs_url":"https://api.github.com/repos/monkeyiq/filesender/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/monkeyiq/filesender/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/monkeyiq/filesender/git/refs{/sha}","trees_url":"https://api.github.com/repos/monkeyiq/filesender/git/trees{/sha}","statuses_url":"https://api.github.com/repos/monkeyiq/filesender/statuses/{sha}","languages_url":"https://api.github.com/repos/monkeyiq/filesender/languages","stargazers_url":"https://api.github.com/repos/monkeyiq/filesender/stargazers","contributors_url":"https://api.github.com/repos/monkeyiq/filesender/contributors","subscribers_url":"https://api.github.com/repos/monkeyiq/filesender/subscribers","subscription_url":"https://api.github.com/repos/monkeyiq/filesender/subscription","commits_url":"https://api.github.com/repos/monkeyiq/filesender/commits{/sha}","git_commits_url":"https://api.github.com/repos/monkeyiq/filesender/git/commits{/sha}","comments_url":"https://api.github.com/repos/monkeyiq/filesender/comments{/number}","issue_comment_url":"https://api.github.com/repos/monkeyiq/filesender/issues/comments{/number}","contents_url":"https://api.github.com/repos/monkeyiq/filesender/contents/{+path}","compare_url":"https://api.github.com/repos/monkeyiq/filesender/compare/{base}...{head}","merges_url":"https://api.github.com/repos/monkeyiq/filesender/merges","archive_url":"https://api.github.com/repos/monkeyiq/filesender/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/monkeyiq/filesender/downloads","issues_url":"https://api.github.com/repos/monkeyiq/filesender/issues{/number}","pulls_url":"https://api.github.com/repos/monkeyiq/filesender/pulls{/number}","milestones_url":"https://api.github.com/repos/monkeyiq/filesender/milestones{/number}","notifications_url":"https://api.github.com/repos/monkeyiq/filesender/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/monkeyiq/filesender/labels{/name}","releases_url":"https://api.github.com/repos/monkeyiq/filesender/releases{/id}","deployments_url":"https://api.github.com/repos/monkeyiq/filesender/deployments","created_at":"2017-03-29T11:49:05Z","updated_at":"2017-03-29T11:49:08Z","pushed_at":"2018-07-16T06:37:57Z","git_url":"git://github.com/monkeyiq/filesender.git","ssh_url":"git@github.com:monkeyiq/filesender.git","clone_url":"https://github.com/monkeyiq/filesender.git","svn_url":"https://github.com/monkeyiq/filesender","homepage":"http://filesender.org","size":114831,"stargazers_count":0,"watchers_count":0,"language":"PHP","has_issues":false,"has_projects":true,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":0,"mirror_url":null,"archived":false,"open_issues_count":0,"license":{"key":"bsd-3-clause","name":"BSD 3-Clause \"New\" or \"Revised\" License","spdx_id":"BSD-3-Clause","url":"https://api.github.com/licenses/bsd-3-clause","node_id":"MDc6TGljZW5zZTU="},"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"filesender:master","ref":"master","sha":"719de3d95413ecb31960c87c92d2b1d2f456c51e","user":{"login":"filesender","id":18323597,"node_id":"MDEyOk9yZ2FuaXphdGlvbjE4MzIzNTk3","avatar_url":"https://avatars3.githubusercontent.com/u/18323597?v=4","gravatar_id":"","url":"https://api.github.com/users/filesender","html_url":"https://github.com/filesender","followers_url":"https://api.github.com/users/filesender/followers","following_url":"https://api.github.com/users/filesender/following{/other_user}","gists_url":"https://api.github.com/users/filesender/gists{/gist_id}","starred_url":"https://api.github.com/users/filesender/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/filesender/subscriptions","organizations_url":"https://api.github.com/users/filesender/orgs","repos_url":"https://api.github.com/users/filesender/repos","events_url":"https://api.github.com/users/filesender/events{/privacy}","received_events_url":"https://api.github.com/users/filesender/received_events","type":"Organization","site_admin":false},"repo":{"id":55674745,"node_id":"MDEwOlJlcG9zaXRvcnk1NTY3NDc0NQ==","name":"filesender","full_name":"filesender/filesender","owner":{"login":"filesender","id":18323597,"node_id":"MDEyOk9yZ2FuaXphdGlvbjE4MzIzNTk3","avatar_url":"https://avatars3.githubusercontent.com/u/18323597?v=4","gravatar_id":"","url":"https://api.github.com/users/filesender","html_url":"https://github.com/filesender","followers_url":"https://api.github.com/users/filesender/followers","following_url":"https://api.github.com/users/filesender/following{/other_user}","gists_url":"https://api.github.com/users/filesender/gists{/gist_id}","starred_url":"https://api.github.com/users/filesender/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/filesender/subscriptions","organizations_url":"https://api.github.com/users/filesender/orgs","repos_url":"https://api.github.com/users/filesender/repos","events_url":"https://api.github.com/users/filesender/events{/privacy}","received_events_url":"https://api.github.com/users/filesender/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/filesender/filesender","description":"FileSender server software","fork":false,"url":"https://api.github.com/repos/filesender/filesender","forks_url":"https://api.github.com/repos/filesender/filesender/forks","keys_url":"https://api.github.com/repos/filesender/filesender/keys{/key_id}","collaborators_url":"https://api.github.com/repos/filesender/filesender/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/filesender/filesender/teams","hooks_url":"https://api.github.com/repos/filesender/filesender/hooks","issue_events_url":"https://api.github.com/repos/filesender/filesender/issues/events{/number}","events_url":"https://api.github.com/repos/filesender/filesender/events","assignees_url":"https://api.github.com/repos/filesender/filesender/assignees{/user}","branches_url":"https://api.github.com/repos/filesender/filesender/branches{/branch}","tags_url":"https://api.github.com/repos/filesender/filesender/tags","blobs_url":"https://api.github.com/repos/filesender/filesender/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/filesender/filesender/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/filesender/filesender/git/refs{/sha}","trees_url":"https://api.github.com/repos/filesender/filesender/git/trees{/sha}","statuses_url":"https://api.github.com/repos/filesender/filesender/statuses/{sha}","languages_url":"https://api.github.com/repos/filesender/filesender/languages","stargazers_url":"https://api.github.com/repos/filesender/filesender/stargazers","contributors_url":"https://api.github.com/repos/filesender/filesender/contributors","subscribers_url":"https://api.github.com/repos/filesender/filesender/subscribers","subscription_url":"https://api.github.com/repos/filesender/filesender/subscription","commits_url":"https://api.github.com/repos/filesender/filesender/commits{/sha}","git_commits_url":"https://api.github.com/repos/filesender/filesender/git/commits{/sha}","comments_url":"https://api.github.com/repos/filesender/filesender/comments{/number}","issue_comment_url":"https://api.github.com/repos/filesender/filesender/issues/comments{/number}","contents_url":"https://api.github.com/repos/filesender/filesender/contents/{+path}","compare_url":"https://api.github.com/repos/filesender/filesender/compare/{base}...{head}","merges_url":"https://api.github.com/repos/filesender/filesender/merges","archive_url":"https://api.github.com/repos/filesender/filesender/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/filesender/filesender/downloads","issues_url":"https://api.github.com/repos/filesender/filesender/issues{/number}","pulls_url":"https://api.github.com/repos/filesender/filesender/pulls{/number}","milestones_url":"https://api.github.com/repos/filesender/filesender/milestones{/number}","notifications_url":"https://api.github.com/repos/filesender/filesender/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/filesender/filesender/labels{/name}","releases_url":"https://api.github.com/repos/filesender/filesender/releases{/id}","deployments_url":"https://api.github.com/repos/filesender/filesender/deployments","created_at":"2016-04-07T07:50:08Z","updated_at":"2018-07-15T01:24:15Z","pushed_at":"2018-07-15T01:24:13Z","git_url":"git://github.com/filesender/filesender.git","ssh_url":"git@github.com:filesender/filesender.git","clone_url":"https://github.com/filesender/filesender.git","svn_url":"https://github.com/filesender/filesender","homepage":"http://filesender.org","size":115512,"stargazers_count":29,"watchers_count":29,"language":"PHP","has_issues":true,"has_projects":true,"has_downloads":true,"has_wiki":false,"has_pages":true,"forks_count":29,"mirror_url":null,"archived":false,"open_issues_count":54,"license":{"key":"bsd-3-clause","name":"BSD 3-Clause \"New\" or \"Revised\" License","spdx_id":"BSD-3-Clause","url":"https://api.github.com/licenses/bsd-3-clause","node_id":"MDc6TGljZW5zZTU="},"forks":29,"open_issues":54,"watchers":29,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/filesender/filesender/pulls/375"},"html":{"href":"https://github.com/filesender/filesender/pull/375"},"issue":{"href":"https://api.github.com/repos/filesender/filesender/issues/375"},"comments":{"href":"https://api.github.com/repos/filesender/filesender/issues/375/comments"},"review_comments":{"href":"https://api.github.com/repos/filesender/filesender/pulls/375/comments"},"review_comment":{"href":"https://api.github.com/repos/filesender/filesender/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/filesender/filesender/pulls/375/commits"},"statuses":{"href":"https://api.github.com/repos/filesender/filesender/statuses/a46a93aaa900a42d270c05a0e6976b22de978dce"}},"author_association":"CONTRIBUTOR","merged":false,"mergeable":null,"rebaseable":null,"mergeable_state":"unknown","merged_by":null,"comments":0,"review_comments":0,"maintainer_can_modify":true,"commits":1,"additions":163,"deletions":33,"changed_files":12}}
{"actor":{"display_login":"monkeyiq"}}