tozny/java-aes-crypto

Users be warned. SHA 256 instead of PBKDF2

JohnOberhauser opened this issue · 2 comments

The key derivation function in the library is SHA 256. SHA 256 is fast, so deriving the key will be easier than if this library used PBKDF2. This means the encrypted data is extra vulnerable if you have a weak password.

whoops, meant to type this somewhere else... Too many windows open 🤷‍♂️

Just to be clear, this library DOES use a proper password-based key derivation function. Thanks for correcting the report :)