r4nx / cryptomsg Goto Github PK

aeslua library generates IV after first encryption or decryption, so 2 same plaintexts will give you same ciphertext, if you encrypt it right after script loading.

Possible solutions:

1. Call encrypt function on startup to generate IV.
   This is not a very good way, because it solves consequence, but not the cause.
2. Use other cryptography library, such as lockbox.

The second is preferable to the first because of other security issues of aeslua such as weak PDF (it just encrypt password with itself using AES-CBC).