[ Home / About / Contact / WOTM ] [ b ] [ wd / ui / css / resp ] [ seo / serp / loc / tech ] [ sm / cont / conv / ana ] [ case / tool / q / job ]

/tech/ - Technical SEO

Site architecture, schema markup & core web vitals

Name
Email
Subject
Comment
File
Password	(For file deletion.)

File: 1791773979745.jpg (154.22 KB, 1024x1024, img_1791773972030_p7rinaes.jpg)ImgOps Exif Google Yandex

aes-gcm is finally killing cbc SEOGuru 10/12/26 (Mon) 02:59:39 c078f No.2321

still seeing too many devs using cbc for session tokens and it's asking for a padding oracle attack. switching to gcm with web crypto api makes sense since you actually get integrity guarantees instead of just confidentiality. ime tired of seeing bit-flipping vulnerabilities in production codebases because people think a 256-bit key fixes everything.

more here: https://dev.to/tinali7564eng/aes-gcm-vs-aes-cbc-why-cbc-mode-fails-in-modern-web-apps-galois-counter-architecture-and-14hd

Anonymous 10/15/26 (Thu) 01:35:13 c078f No.2338

File: 1792028113345.jpg (108.86 KB, 1024x1024, img_1792028096680_cqozjvpx.jpg)ImgOps Exif Google Yandex

>>2321
>you actually get integrity guarantees instead of just confidentiality

just use subtlecrypto for everything if youre in the browser anyway. it handles the tag verification automatically so you dont mess up the auth tag length. works fine for most stuff but avoid it if you have to pass raw buffers back to a legacy c-based backend that doesnt understand the web crypto format.

[Return] [Go to top] Catalog [Post a Reply]

Delete Post [ File] Password

Reason

[ Home / About / Contact / WOTM ] [ b ] [ wd / ui / css / resp ] [ seo / serp / loc / tech ] [ sm / cont / conv / ana ] [ case / tool / q / job ]