6

We are using 'crypto.js' in our application.

Since 'crypto.js' uses open SSL ,are we vulnerable to heartbleeding attack?

If yes, what can we do to prevent it?

Improve this question
2
  • Where does your crypto.js come from? Are you talking about this one on Google Code?
    – Ladadadada
    Apr 14, 2014 at 11:12
  • @Ladadadada We are using version 3.0.2 of cryptojs. We have downloaded from the source mentioned by you.
    – user44548
    Apr 14, 2014 at 11:25

2 Answers 2

Reset to default
5

Crypto.js does not use OpenSSL, it is interoperable with some of the same algorithms, and is not vulnerable to Heartbleed. All the more so because usually you use crypto.js on the client, not on the OpenSSLified server.

Improve this answer
6
  • @Iserni Thanks for your prompt reply.Does the mention of 'OpenSSL' in cryptojs.js file make it vulnerable to the attack ,even though it is not being used.
    – user44548
    Apr 14, 2014 at 11:19
  • user44548 - what bit of Iserni's answer confuses you? He has explicitly stated it is not vulnerable.
    – Rory Alsop ♦
    Apr 14, 2014 at 14:35
  • @user44548, no, merely "mentioning" a software is not enough to evoke an attack. Even if software engineering does sometimes make one think of forbidden magic. Things would be different if the "mentioning" was actually an executable call. In this case it is not.
    – LSerni
    Apr 14, 2014 at 16:04
  • @user44548 "Does the mention of 'OpenSSL' in cryptojs.js file make it vulnerable to the attack" lol wat?
    – 0x6A75616E
    Apr 15, 2014 at 1:37
  • 2
    Does the mention of OpenSSL in this answer make it vulnerable to heartbleed?
    – Matt
    Apr 15, 2014 at 2:01
1

If you browse the Crypto.js source, it does not implement TLS (or SSL), and as such can't implement the TLS extension Heartbeats. By not implementing TLS or Heartbeats, it can't have the Heartbeat vulnerability exploited by Heartbleed (trusting the payload length in a HB request even if its longer than the original message and echoing back that much data).

Yes, there are a couple references to OpenSSL in cryptoJS (all within cipher-core.js, but those are merely in response to either using an OpenSSL key format (e.g., its in code defined within cryptoJS with CryptoJS.format.OpenSSL) or using an OpenSSL key-derivation-function (OpenSSLKdf = C_kdf.OpenSSL). Note, cryptojs does not link to the OpenSSL library or call the OpenSSL executable.

Improve this answer

Not the answer you're looking for? Browse other questions tagged .