[
https://issues.apache.org/jira/browse/WICKET-7190?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18105622#comment-18105622
]
ASF subversion and git services commented on WICKET-7190:
---------------------------------------------------------
Commit 31b7ce12f69e321eb2652cac0c75aa751c727041 in wicket's branch
refs/heads/master from Emond Papegaaij
[ https://gitbox.apache.org/repos/asf?p=wicket.git;h=31b7ce12f6 ]
WICKET-7190 Bind encrypted pages to their page id via AEAD associated data
Expose associated data (AAD) in the crypt API and use it to bind each encrypted
page to its id:
- ICrypt gains encrypt(byte[], byte[] associatedData) and
decrypt(byte[], byte[] associatedData); the no-arg overloads delegate with no
associated data. SchemeCrypt authenticates marker || associatedData, so the
no-associated-data path is unchanged and URL/cookie ciphertext is unaffected.
- CryptingPageStore passes the page id (4 big-endian bytes) as associated data,
using the trusted id parameter on getPage and the server-assigned id on
addPage. A blob stored for one id can no longer be substituted into another
slot by a tamper-capable storage adversary: it fails authentication and is
treated as a cache miss.
URLs (CryptoMapper) and the remember-me cookie bind no associated data: there is
no useful context to add (the session is redundant under a per-session key and
breaks URL sharing under an application-wide key; request-specific context would
break bookmarkability).
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
> Unified cryptography API
> ------------------------
>
> Key: WICKET-7190
> URL: https://issues.apache.org/jira/browse/WICKET-7190
> Project: Wicket
> Issue Type: New Feature
> Components: wicket-core
> Reporter: Emond Papegaaij
> Assignee: Emond Papegaaij
> Priority: Major
> Fix For: 11.0.0
>
>
> The current cryptography API in Wicket is split over {{ICrypt}} and
> {{ICrypter}}. Both APIs serve a similar purpose but for different subsystems.
> The goal is to unify these APIs and to allow the implementation of more
> modern ciphers, with AEAD support. Also, the documentation on this API and
> its implementations must be improved, clearly stating what it does and what
> it does not deliver.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
