mojic

commit 602c8b7ffe0086f48208074906f3d2f1187891c9
parent 6a4a535bbd6ab656509dcb2d90e53efdbd481ed6
Author: Amit Dutta <mail@amit.is-a.dev>
Date:   Tue,  4 Aug 2026 08:50:40 +0530

Refactor CipherEngine for security enhancements

Removed the operation name from the header comment and updated the authentication check to use timing-safe comparison.
Diffstat:
M
lib/CipherEngine.js
 | 
5
+++--

1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/lib/CipherEngine.js b/lib/CipherEngine.js
@@ -4,7 +4,6 @@ import { StringDecoder } from 'string_decoder';
 
 /**
  * MOJIC v2.1.5 CIPHER ENGINE
- * "Operation Ironclad"
  * * Security Upgrades:
  * - KDF: Upgraded from PBKDF2 to Scrypt (Memory-Hard, GPU-Resistant)
  * - PRNG: Upgraded from Xoshiro256** to AES-256-CTR (Cryptographically Secure)
@@ -135,7 +134,9 @@ export class CipherEngine {
         
         if (expectedAuthCheck) {
             const calculatedAuthCheck = this.authKey.subarray(0, 4).toString('hex');
-            if (calculatedAuthCheck !== expectedAuthCheck) {
+            const calcAuthBuffer = Buffer.from(calculatedAuthCheck, 'hex');
+            const expectedAuthBuffer = Buffer.from(expectedAuthCheck, 'hex');
+            if (calcAuthBuffer.length !== expectedAuthBuffer.length || !crypto.timingSafeEqual(calcAuthBuffer, expectedAuthBuffer)) {
                 throw new Error("WRONG_PASSWORD");
             }
         }