Return to Answer

defaultCiphers = ['RC4'] - is this acceptable? I've heard that RC4 is broken.

About RC4 vulnerabilities in general, see e.g. Google is using RC4, but isn't RC4 considered unsafe?

RC4 can be secure when you discard (enough of) the beginning of the keystream or use a new key each session. Since node.js calls into OpenSSL, I don't think it does the former and can't see it done in secure-peer either.

From a look at the secure-peer source, it seems like they use Diffie-Hellman to get a shared secret and use that to derive the RC4 key and IV. That is should be safe, but I could be reading it wrong.

To test, you could try printing secret before this line:

var encrypt = crypto.createCipher(cipher, secret);

If it's different each time (for the same pair of peers), it's probably fine. Otherwise, there may be cause for concern.

Are my example RSA keys flawed?

They certainly are now that you published them :)

But, no, probably not. RSA keys are stored in one of several formats that have some leading and trailing data that is similar for keys made using the same implementation.

1. The keys have format and version tags.
2. They may have information regarding whether the key is stored encrypted and with what algorithm, presumably the same.
3. The public key exponent is usually chosen as e.g. 65537 for all keys.

defaultCiphers = ['RC4'] - is this acceptable? I've heard that RC4 is broken.

About RC4 vulnerabilities in general, see e.g. Google is using RC4, but isn't RC4 considered unsafe?

RC4 can be secure when you discard (enough of) the beginning of the keystream or use a new key each session. Since node.js calls into OpenSSL, I don't think it does the former and can't see it done in secure-peer either.

From a look at the secure-peer source, it seems like they use Diffie-Hellman to get a shared secret and use that to derive the RC4 key and IV. That is should be safe, but I could be reading it wrong.

To test, you could try printing secret before this line:

var encrypt = crypto.createCipher(cipher, secret);

If it's different each time (for the same pair of peers), it's probably fine. Otherwise, there may be cause for concern.

Are my example RSA keys flawed?

They certainly are now that you published them :)

But, no, probably not. RSA keys are stored in one of several formats that have some leading and trailing data that is similar for keys made using the same implementation.

1. The keys have format and version tags.
2. They may have information regarding whether the key is stored encrypted and with what algorithm, presumably the same.
3. The public key exponent is usually chosen as e.g. 65537 for all keys.

defaultCiphers = ['RC4'] - is this acceptable? I've heard that RC4 is broken.

About RC4 vulnerabilities in general, see e.g. Google is using RC4, but isn't RC4 considered unsafe?

RC4 can be secure when you discard (enough of) the beginning of the keystream or use a new key each session. Since node.js calls into OpenSSL, I don't think it does the former and can't see it done in secure-peer either.

From a look at the secure-peer source, it seems like they use Diffie-Hellman to get a shared secret and use that to derive the RC4 key and IV. That is should be safe, but I could be reading it wrong.

To test, you could try printing secret before this line:

var encrypt = crypto.createCipher(cipher, secret);

If it's different each time (for the same pair of peers), it's probably fine. Otherwise, there may be cause for concern.

Are my example RSA keys flawed?

They certainly are now that you published them :)

But, no, probably not. RSA keys are stored in one of several formats that have some leading and trailing data that is similar for keys made using the same implementation.

1. The keys have format and version tags.
2. They may have information regarding whether the key is stored encrypted and with what algorithm, presumably the same.
3. The public key exponent is usually chosen as e.g. 65537 for all keys.

defaultCiphers = ['RC4'] - is this acceptable? I've heard that RC4 is broken.

About RC4 vulnerabilities in general, see e.g. Google is using RC4, but isn't RC4 considered unsafe?

RC4 can be secure when you discard (enough of) the beginning of the keystream or use a new key each session. Since node.js calls into OpenSSL, I don't think it does the former and can't see it done in secure-peer either.

From a look at the secure-peer source, it seems like they use Diffie-Hellman to get a shared secret and use that to derive the RC4 key and IV. That is should be safe, but I could be reading it wrong.

To test, you could try printing secret before this line:

var encrypt = crypto.createCipher(cipher, secret);

If it's different each time (for the same pair of peers), it's probably fine. Otherwise, there may be cause for concern.

Are my example RSA keys flawed?

They certainly are now that you published them :)

But, no, probably not. RSA keys are stored in one of several formats that have some leading and trailing data that is similar for keys made using the same implementation.

1. The keys have format and version tags.
2. They may have information regarding whether the key is stored encrypted and with what algorithm, presumably the same.
3. The public key exponent is usually chosen as e.g. 65537 for all keys.

defaultCiphers = ['RC4'] - is this acceptable? I've heard that RC4 is broken.

About RC4 vulnerabilities in general, see e.g. Google is using RC4, but isn't RC4 considered unsafe?

RC4 can be secure when you discard (enough of) the beginning of the keystream or use a new key each session. Since node.js calls into OpenSSL, I don't think it does the former and can't see it done in secure-peer either.

From a look at the secure-peer source, it seems like they use Diffie-Hellman to get a shared secret and use that to derive the RC4 key and IV. That is should be safe, but I could be reading it wrong.

To test, you could try printing secret before this line:

var encrypt = crypto.createCipher(cipher, secret);

If it's different each time (for the same pair of peers), it's probably fine. Otherwise, there may be cause for concern.

Are my example RSA keys flawed?

They certainly are now that you published them :)

But, no, probably not. RSA keys have a well defined format that has some leading and trailing data that is similar for keys made using the same implementation.

1. The keys start with a format version tag.
2. They have information regarding whether the key is stored encrypted and with what algorithm, presumably the same.
3. The public key ends with the public exponent, which is usually chosen as e.g. 65537 for all keys.

defaultCiphers = ['RC4'] - is this acceptable? I've heard that RC4 is broken.

About RC4 vulnerabilities in general, see e.g. Google is using RC4, but isn't RC4 considered unsafe?

RC4 can be secure when you discard (enough of) the beginning of the keystream or use a new key each session. Since node.js calls into OpenSSL, I don't think it does the former and can't see it done in secure-peer either.

From a look at the secure-peer source, it seems like they use Diffie-Hellman to get a shared secret and use that to derive the RC4 key and IV. That is should be safe, but I could be reading it wrong.

To test, you could try printing secret before this line:

var encrypt = crypto.createCipher(cipher, secret);

If it's different each time (for the same pair of peers), it's probably fine. Otherwise, there may be cause for concern.

Are my example RSA keys flawed?

They certainly are now that you published them :)

But, no, probably not. RSA keys are stored in one of several formats that have some leading and trailing data that is similar for keys made using the same implementation.

1. The keys have format and version tags.
2. They may have information regarding whether the key is stored encrypted and with what algorithm, presumably the same.
3. The public key exponent is usually chosen as e.g. 65537 for all keys.