nspcc-dev/neofs-s3-gw

mirror of https://github.com/nspcc-dev/neofs-s3-gw.git synced 2026-03-01 04:29:15 +00:00

Potentially insecure hkdf use #444

New issue

Closed

opened 2025-12-28 17:37:25 +00:00 by sami · 2 comments

sami commented

2025-12-28 17:37:25 +00:00

Owner

Originally created by @roman-khimov on GitHub (May 14, 2024).

Originally assigned to: @smallhive on GitHub.

Current Behavior

kdf := hkdf.New(hash, secret, nil, nil). No salt, no app-specific info.

Expected Behavior

App-specific info and salt used.

Possible Solution

Hardcode info, add some salt. Breaking change, but the gateway is not used in production.

Your Environment

Version of the product used: 0.30.0

Originally created by @roman-khimov on GitHub (May 14, 2024). Originally assigned to: @smallhive on GitHub. ## Current Behavior `kdf := hkdf.New(hash, secret, nil, nil)`. No salt, no app-specific info. ## Expected Behavior App-specific info and salt used. ## Possible Solution Hardcode info, add some salt. Breaking change, but the gateway is not used in production. ## Your Environment * Version of the product used: 0.30.0

sami

2025-12-28 17:37:25 +00:00

closed this issue
added the
bug

S2

I4

U2

security
labels

sami commented

2025-12-28 17:37:25 +00:00

Author

Owner

@roman-khimov commented on GitHub (Jun 28, 2024):

Salt is to be stored somewhere nearby, as usual.

@roman-khimov commented on GitHub (Jun 28, 2024): Salt is to be stored somewhere nearby, as usual.

sami commented

2025-12-28 17:37:25 +00:00

Author

Owner

@cthulhu-rider commented on GitHub (Jul 3, 2024):

Salt is to be stored somewhere

what do u mean - in what storage?

@cthulhu-rider commented on GitHub (Jul 3, 2024): > Salt is to be stored somewhere what do u mean - in what storage?

Sign in to join this conversation.

No labels

good first issue

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

nspcc-dev/neofs-s3-gw#444

No description provided.