We are using 'crypto.js' in our application.
Since 'crypto.js' uses open SSL ,are we vulnerable to heartbleeding attack?
If yes, what can we do to prevent it?
2
-
Where does your crypto.js come from? Are you talking about this one on Google Code?– LadadadadaCommented Apr 14, 2014 at 11:12
-
@Ladadadada We are using version 3.0.2 of cryptojs. We have downloaded from the source mentioned by you.– user44548Commented Apr 14, 2014 at 11:25
Add a comment
|
2 Answers
Crypto.js does not use OpenSSL, it is interoperable with some of the same algorithms, and is not vulnerable to Heartbleed. All the more so because usually you use crypto.js on the client, not on the OpenSSLified server.
-
@Iserni Thanks for your prompt reply.Does the mention of 'OpenSSL' in cryptojs.js file make it vulnerable to the attack ,even though it is not being used. Commented Apr 14, 2014 at 11:19
-
user44548 - what bit of Iserni's answer confuses you? He has explicitly stated it is not vulnerable.– Rory Alsop ♦Commented Apr 14, 2014 at 14:35
-
@user44548, no, merely "mentioning" a software is not enough to evoke an attack. Even if software engineering does sometimes make one think of forbidden magic. Things would be different if the "mentioning" was actually an executable call. In this case it is not.– LSerniCommented Apr 14, 2014 at 16:04
-
@user44548 "Does the mention of 'OpenSSL' in cryptojs.js file make it vulnerable to the attack" lol wat? Commented Apr 15, 2014 at 1:37
-
2Does the mention of OpenSSL in this answer make it vulnerable to heartbleed?– MattCommented Apr 15, 2014 at 2:01
If you browse the Crypto.js source, it does not implement TLS (or SSL), and as such can't implement the TLS extension Heartbeats. By not implementing TLS or Heartbeats, it can't have the Heartbeat vulnerability exploited by Heartbleed (trusting the payload length in a HB request even if its longer than the original message and echoing back that much data).
Yes, there are a couple references to OpenSSL in cryptoJS (all within cipher-core.js, but those are merely in response to either using an OpenSSL key format (e.g., its in code defined within cryptoJS with CryptoJS.format.OpenSSL) or using an OpenSSL key-derivation-function (OpenSSLKdf = C_kdf.OpenSSL). Note, cryptojs does not link to the OpenSSL library or call the OpenSSL executable.
answered Apr 14, 2014 at 17:46
