Users be warned. SHA 256 instead of PBKDF2
JohnOberhauser opened this issue · 2 comments
JohnOberhauser commented
The key derivation function in the library is SHA 256. SHA 256 is fast, so deriving the key will be easier than if this library used PBKDF2. This means the encrypted data is extra vulnerable if you have a weak password.
JohnOberhauser commented
whoops, meant to type this somewhere else... Too many windows open 🤷♂️
SyntaxPolice commented
Just to be clear, this library DOES use a proper password-based key derivation function. Thanks for correcting the report :)