Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
cbc-partial-decrypt
Advanced tools
Returns a stream of partial contents of an AES-CBC encrypted resource
In CBC mode, the only thing needed to decrypt a specific block, is the ciphertext, key and previous ciphertext (to use as IV).
This library takes advantage of that, and implements partial decryption for AES-CBC with 128, 192 or 256 key length. Although other algorithms should be possible to implement as well.
It will return a stream that can be read, and will emit the resource decrypted from byte start
to byte end
specified.
var partialDecryptStream = require('cbc-partial-decrypt')
var opts = {
mode: 'aes-cbc-256', // which encryption algorithm and mode to use, passed directly to internal decipher
keyLength: 256, // They keylength to use, to generate the Buffer version if password as a string is used
password: 'password', // The password to use, either text or Buffer
iv: 'd', // optional: initial IV with which the file was encrypted. If blank, the default one will be used
start: 0, // optional: first byte to receive. Default 0
end: 250, // optional: last byte to receive, included. Default until end of file
// Function that should have the same signature as fs.createReadStream, and should
// return a stream that reads the resource to decrypt. opts will have `start` and `end`.
// They will be different to the ones above, as this function will require the resource needed
// to also get the IV, and handles the blocksize of AES, so every part can be properly decrypted
encrypted: function (opts) {
return fs.createReadStream('path', opts)
}
}
partialDecryptStream(opts).pipe(process.stdout) // prints partial resource
This library uses setAutoPadding(false)
on the internal crypto.createDecipheriv()
, so it is recommended to know the original size of the
resource, and use it as end
when reading until the end of the file, as the default padding
will be emitted as data as well, unless cut out.
The library only offers to return back a stream, but the method should work aswell done synchronously with a part of the resource. Happy to accept PR with this functionality.
As CBC is the block mode, but not the algoritmh itself, it should also be possible to implement this method with different cryptographic algorithms. Happy to accept PR with this functionality.
FAQs
Returns a stream of partial contents of an AES-CBC encrypted resource
We found that cbc-partial-decrypt demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.