crypto: use secret directly instead of deriving key

2024-03-05 16:49:00 +00:00
parent fc39ac76b6
commit 7fab5a37ff
3 changed files with 6 additions and 9 deletions
--- a/src/modules/stream/manage.js
+++ b/src/modules/stream/manage.js
@@ -20,7 +20,7 @@ const hmacSalt = randomBytes(64).toString('hex');
 export function createStream(obj) {
    const streamID = nanoid(),
        iv = randomBytes(16).toString('base64url'),
-        secret = randomBytes(256).toString('base64url'),
+        secret = randomBytes(32).toString('base64url'),
        exp = new Date().getTime() + streamLifespan,
        hmac = generateHmac(`${streamID},${exp},${iv},${secret}`, hmacSalt),
        streamData = {