Use of insecure crypto for storing passwords

[Marc Deslauriers]

remote-login-service caches the information returned from the server (including usernames and passwords) by encrypting it and storing it in a file.

The crypto used for the file is totally wrong and insecure. It is trivial to perform an attack on this file and recover the contents and the user password.

In crypt.c:

- A password should not be used as an AES encryption key. The user password, along with a salt, should be put through a key-derivation function such as PBKDF2 before being used as the AES key.
- The key should not be used as the IV. The IV needs to be random.
- Cipher should at least be GCRY_CIPHER_AES256

[Marc Deslauriers (mdeslaur)]

David, could you take a look at this, and possibly find someone to fix it?
Thanks!

[Marc Deslauriers (mdeslaur)]

This is CVE-2013-1053

[Jamie Strandboge (jdstrand)]

Is there any progress on this?

[Jamie Strandboge (jdstrand)]

Ping re progress?

[Marc Deslauriers (mdeslaur)]

Has there been any progress on resolving this issue for our stable releases?

[David Barth (dbarth)]

yes, a merge proposal is in the works

[Marc Deslauriers (mdeslaur)]

Has there been any progress on this?