[GUACAMOLE-1286] Support a custom IV in guacamole-auth-json

• Type: Improvement
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Component/s: guacamole-auth-json
• Assignee: Unassigned
• Reporter: Bojan Zelic
• Created: 11/Feb/21 16:10
• Updated: 12/Feb/21 17:07

Description

It would be nice to support a custom (not-null) IV in guacamole-auth-json

We have a cryptography expert at our company that took a look at the implementation here:

https://github.com/apache/guacamole-client/blob/master/extensions/guacamole-auth-json/src/main/java/org/apache/guacamole/auth/json/CryptoService.java#L76

according to him:

• Having a null-IV coupled with the cipher that Guacamole is using (CBC) is far from ideal from security perspective, even with the signature in the payload it's possible to generate the same cipher-text thus it is bruteforce-able
• He also thinks that it could be nice to use a standard like AEAD (https://en.wikipedia.org/wiki/Authenticated_encryption) in Guacamole instead of using a custom implementation.

We believe that allowing a null-IV could be problematic and allowing a configurable IV would be a great short-term solution.

Issue Links

• relates to: GUACAMOLE-1218 Move guacamole-auth-json into the main project.