{"action":"opened","issue":{"url":"https://api.github.com/repos/erikwt/ParandroidMessaging/issues/20","labels_url":"https://api.github.com/repos/erikwt/ParandroidMessaging/issues/20/labels{/name}","comments_url":"https://api.github.com/repos/erikwt/ParandroidMessaging/issues/20/comments","events_url":"https://api.github.com/repos/erikwt/ParandroidMessaging/issues/20/events","html_url":"https://github.com/erikwt/ParandroidMessaging/issues/20","id":121124664,"number":20,"title":"Use an explicit mode of operation, as \"AES\" defaults to insecure ECB mode","user":{"login":"totalvoidness","id":1204330,"avatar_url":"https://avatars.githubusercontent.com/u/1204330?v=3","gravatar_id":"","url":"https://api.github.com/users/totalvoidness","html_url":"https://github.com/totalvoidness","followers_url":"https://api.github.com/users/totalvoidness/followers","following_url":"https://api.github.com/users/totalvoidness/following{/other_user}","gists_url":"https://api.github.com/users/totalvoidness/gists{/gist_id}","starred_url":"https://api.github.com/users/totalvoidness/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/totalvoidness/subscriptions","organizations_url":"https://api.github.com/users/totalvoidness/orgs","repos_url":"https://api.github.com/users/totalvoidness/repos","events_url":"https://api.github.com/users/totalvoidness/events{/privacy}","received_events_url":"https://api.github.com/users/totalvoidness/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-12-08T23:26:58Z","updated_at":"2015-12-08T23:26:58Z","closed_at":null,"body":"Currently you encrypt messages using `Cipher cipher = Cipher.getInstance(MessageEncryptionFactory.ENCRYPTION_ALGORITHM);` with `MessageEncryptionFactory.ENCRYPTION_ALGORITHM = \"AES\";`\r\n\r\n[AES however defaults to ECB mode](http://security.stackexchange.com/a/57071/78702), which is not secure when we're talking about messages longer than 128 bit. E.g. \"hiWorld!hiWorld!\" would result in a regular pattern.\r\n\r\nIf you don't want to send an IV inside message (due to 160 char restriction), use a hard coded one. This way attackers could see that two SMS are the same, but at least are unable to identify patterns."}}