See the trail of bits blog about this that analyzes it in detail.
See ricmoo/aes-js#113 for the same issue in a similar library.
At the very minimum the Readme should be adjusted, so the insecure mode by using the default IV is not suggested anymore.
Best would be a breaking change to force users to provide an IV.
See the trail of bits blog about this that analyzes it in detail.
See ricmoo/aes-js#113 for the same issue in a similar library.
At the very minimum the Readme should be adjusted, so the insecure mode by using the default IV is not suggested anymore.
Best would be a breaking change to force users to provide an IV.