Skip to content
This repository has been archived by the owner on Jul 2, 2022. It is now read-only.

Initialization vector for PIN-derived key is set to NULL on new identities #39

Open
rijswijk opened this issue Sep 12, 2013 · 0 comments
Assignees
Labels

Comments

@rijswijk
Copy link

While investigating issues #35, #36 and #37 we discovered that the initialization vector (IV) for the PIN-derived encryption key used to encrypt/decrypt the secret belonging to an identity is set to NULL for new identities. This initialization vector is input for the encrypt/decrypt methods in SecretStore.m

Funnily enough, for existing pre-tiqr 2.0 identities that are upgraded by the app, the IV is set correctly in the method upgradeWithPIN in Identity+Utils.m.

The fix is to set a random IV when a new identity is created, and to upgrade existing identities that have their IV set to NULL using a versioning approach.

@ghost ghost assigned ijansch Sep 12, 2013
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
Development

No branches or pull requests

2 participants