You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Hi,
When using a different implementation of Buffer within the code, the code of RNQC fails when the underlying ArrayBuffer is larger than the view the Buffer represents.
For example, when using Buffer#slice or Buffer#subarray, it makes a shallow copy of the Buffer by creating a new view of the underlying ArrayBuffer with the appropriate byteOffset.
The issue is that when two different versions of the Buffer constructor are used, the bufferLikeToArrayBuffer function attempts to convert the input to a Buffer by reading the buffer property, which omits completely the byteOffset of the input object when applicable.
This may cause issues in real life, for example when you have to split a 64 bytes symmetric key into two sub-keys of 32 bytes (for encryption and authentication) which causes the key length to be invalid or when you have to split a ciphertext into the IV, the MAC and the AES output, which causes the IV length to be invalid.
This seems very similar to an issue I reported a few years ago: #104
Reproducible Code
import{Button,Text,View}from'react-native'importQuickCryptofrom'react-native-quick-crypto'import{Buffer}from'@craftzdog/react-native-buffer'import{BufferasFerossBuffer}from'buffer'constclearText='test'consttestCase=(largeKey: Buffer)=>{constkey=largeKey.subarray(32)// Gets a new Uint8Array view of the ArrayBuffer store for this arrayconstiv=QuickCrypto.randomBytes(16)constcipher=QuickCrypto.createCipheriv('aes-256-cbc',key,iv)constenc=Buffer.concat([cipher.update(Buffer.from(clearText))asunknownasBuffer,cipher.final()asunknownasBuffer])constencB64=enc.toString('base64')constdecipher=QuickCrypto.createDecipheriv('aes-256-cbc',key,iv)constdec=Buffer.concat([decipher.update(Buffer.from(encB64,'base64'))asunknownasBuffer,decipher.final()asunknownasBuffer])returndec.toString()===clearText}consttest=()=>{constlargeKey=QuickCrypto.randomBytes(64)console.log('normal Buffer',testCase(largeKey))constlargeKeyFeross=FerossBuffer.from(largeKey.toString('base64'),'base64')// not an instance of '@craftzdog/react-native-buffer', but of 'buffer'console.log('Feross Buffer',testCase(largeKeyFerossasunknownasBuffer))// This fails with 'ERROR Error: Exception in HostFunction: Invalid Cipher key length!, js engine: hermes'}exportdefaultfunctionIndex(){return(<Viewstyle={{flex: 1,justifyContent: "center",alignItems: "center",}}><Text>Edit app/index.tsx to edit this screen.</Text><Buttontitle="test"onPress={()=>test()}></Button></View>);}
What's happening?
Hi,
When using a different implementation of
Buffer
within the code, the code of RNQC fails when the underlyingArrayBuffer
is larger than the view theBuffer
represents.For example, when using
Buffer#slice
orBuffer#subarray,
it makes a shallow copy of theBuffer
by creating a new view of the underlyingArrayBuffer
with the appropriatebyteOffset
.The issue is that when two different versions of the
Buffer
constructor are used, thebufferLikeToArrayBuffer
function attempts to convert the input to aBuffer
by reading thebuffer
property, which omits completely thebyteOffset
of the input object when applicable.This may cause issues in real life, for example when you have to split a 64 bytes symmetric key into two sub-keys of 32 bytes (for encryption and authentication) which causes the key length to be invalid or when you have to split a ciphertext into the IV, the MAC and the AES output, which causes the IV length to be invalid.
This seems very similar to an issue I reported a few years ago: #104
Reproducible Code
Relevant log output
Device
Android
QuickCrypto Version
0.7.6
Can you reproduce this issue in the QuickCrypto Example app?
Yes, I can reproduce the same issue in the Example app here
Additional information
The text was updated successfully, but these errors were encountered: