[
https://issues.apache.org/jira/browse/QPID-8504?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17311879#comment-17311879
]
ASF subversion and git services commented on QPID-8504:
-------------------------------------------------------
Commit cf3cc437305223a4af133c05ef2becf4c4b45bcc in qpid-broker-j's branch
refs/heads/main from Alex Rudyy
[ https://gitbox.apache.org/repos/asf?p=qpid-broker-j.git;h=cf3cc43 ]
QPID-8504:[Broker-J] Resolve container attributes before encrypter creation
This closes #81
> [Broker-J] Usage of default mode for "AES" is insecure
> ------------------------------------------------------
>
> Key: QPID-8504
> URL: https://issues.apache.org/jira/browse/QPID-8504
> Project: Qpid
> Issue Type: Improvement
> Reporter: Md Mahir Asef Kabir
> Priority: Major
> Fix For: qpid-java-broker-8.0.4
>
>
> In file
> https://github.com/apache/qpid-broker-j/blob/a70ed6f5edbcf0e8690447d48a1fe64e599cb703/broker-core/src/main/java/org/apache/qpid/server/security/encryption/AESKeyFileEncrypter.java
> (at Line 55), the default "AES" algorithm has been used which imposes
> insecure "ECB" mode.
> *Security Impact*:
> ECB mode allows the attacker to do the following -
> detect whether two ECB-encrypted messages are identical;
> detect whether two ECB-encrypted messages share a common prefix;
> detect whether two ECB-encrypted messages share other common substrings, as
> long as those substrings are aligned at block boundaries; or
> detect whether (and where) a single ECB-encrypted message contains repetitive
> data (such as long runs of spaces or null bytes, repeated header fields, or
> coincidentally repeated phrases in the text). - Collected from
> [here|https://crypto.stackexchange.com/questions/20941/why-shouldnt-i-use-ecb-encryption#:~:text=The%20main%20reason%20not%20to,will%20leak%20to%20some%20extent).]
> *Useful Resources*:
> https://blog.filippo.io/the-ecb-penguin/
> *Solution we suggest*:
> Use GCM mode instead of default or ECB mode.
> *Please share with us your opinions/comments if there is any*:
> Is the bug report helpful?
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscr...@qpid.apache.org
For additional commands, e-mail: dev-h...@qpid.apache.org
