Switch to newer version of cryptiles

[CalRobert]

Github warned about a vulnerability in the used version of cryptiles

[donflopez]

🚀 🌔

[gkwang]

Are we updating the dependencies 1 at a time? There's a couple more that needs to be updated as well.

[CalRobert]

Of the ones that github notified us about, only cryptiles was in package.json. I thought the other dependencies were nested (i.e. dependencies of dependencies) Happy to update others as well.

[gkwang]

Heads up, cryptiles 4.1.2 only supports node 8. hapijs/cryptiles@c44c0e9, the change modifies the function fixedTimeComparison which this library depends on, so this change may warrant a major version bump.

[CalRobert]

@gkwang good point - changed it to 3.1.2 (still an awful lot newer) and this preserves support for Node 6

[david-nossebro]

If the version of Cryptiles is only changed to 3.1.2, I think we still have the security issue mentioned here:
hapijs/cryptiles#34

This issue is solved in 4.1.2 according to this:
https://nvd.nist.gov/vuln/detail/CVE-2018-1000620

This is flagged as a critical issue by the tool "Black Duck Scan" that is used in my project.

[CalRobert]

As I understand it the only clear options are:

• Drop Node 6 support
• Keep this vulnerability (this seems like a bad option to me)
• (time consuming, could be a while) Remove use of cryptiles
• (probably a non-starter) update Cryptiles to support Node 6 again

It may make sense to just drop Node6 and make this a major version release, but I'm curious what others think.

If the version of Cryptiles is only changed to 3.1.2, I think we still have the security issue mentioned here:
hapijs/cryptiles#34

This issue is solved in 4.1.2 according to this:
https://nvd.nist.gov/vuln/detail/CVE-2018-1000620

This is flagged as a critical issue by the tool "Black Duck Scan" that is used in my project.

[david-nossebro]

It may make sense to just drop Node6 and make this a major version release, but I'm curious what others think.

I agree with you.

[gkwang]

From what I'm seeing, we're not using cryptiles' PNRG, so this vulnerability doesn't directly affect us.
The only function we use is "fixedTimeComparison" which is unfortunately the exact function that breaks backwards compat. My vote is we can still bump the major version, and let the users decide whether to update it or not.

[machuga]

@CalRobert Dropping Node 6 isn't a viable option for us at the moment so we'll have to investigate some other approaches.

[david-nossebro]

I have created a pull-request #102 where I removed the 'Cryptiles' dependency.