Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Calling RSA functions with faulty inputs crashes the app #31

Open
pke opened this issue Feb 26, 2021 · 4 comments
Open

Calling RSA functions with faulty inputs crashes the app #31

pke opened this issue Feb 26, 2021 · 4 comments

Comments

@pke
Copy link
Collaborator

pke commented Feb 26, 2021

Would it be possible to catch errors on the native side to not crash the app when exceptions happen on native side?

When handing in invalid data to the RSA functions, like a private key to RSA.encrypt, the app crashes instantly.

@ghbutton
Copy link
Owner

Yea that makes sense, do you have some example data I can test with? Just some throw away private key?

@pke
Copy link
Collaborator Author

pke commented Feb 26, 2021

Thanks for your swift response!
-----BEGIN RSA PRIVATE KEY-----
MIIJJwIBAAKCAgEA9XLTJk9hmXYksPywZvWOXiSVBZImd2/1Psoz5zYBdfDkzBmb
R++7XgMWVhyaTkTkSCjKKQiT+4Qs6HbEZZXTpidtQJQZJcDQMx6NuxwkBBYOSCYs
LBgqEltGsyuKLRt0lExitIOFtJaJmxR3FFwN0mkCwdqAOcI4VOOmqBTp7BdccwxZ
WWYBmwKsOeYWcZChksJuTiRBJdGCyI5JwWJDOY5lLu4B62jusAelisoTCzC+kKiC
tKohTW0BBxLlZ6wW8ZU3/63fB3zZLVhCm7HUrRmml7xzQ4Ifqoqi4aNTdH+moeJD
/4+4Fx/O2/rhDDWVVx1arQC3+oK6XUfrq7eVtuJiItAd4b9qAQhq5OHwLQ6Wlwr2
hUFZ0pq/A78hQ9jPjkKUA9g3WLHazUJvyM92S815V28ocrZNOpPOdjycRqAuslvM
PO41V398+CtJue6UEqP0euB75wdGdhBkRKpj687YWGuGlbOVSKfu5HGnWrsR8zIi
hBjTyzzozY0KA0MZmuVKVJR0M2r5406NfWmoNdowRAbRr7OPkpoZEOKKmlx0BByN
748GtWuDY/USzn8Q5BJ7a/VeWaWxDYq323J9jkFdNkbEDsYP3tstDbMUUr1HCnJz
rOVUJEpy9sdKc22r/1enF+sGkKGqQEg8/vBQN4t85nHxSNoFxZMhbWS1wPsCAwEA
AQKCAgAy/aLOD6m4BupCdoxzJ0pnVnQ7Dwy8vV6Wp802mGqfROdTW3J99FjZhAys
4Q5RelBuiULOWYDcvK3TsXDFpeWtW/1/cAT1aeQW6p8JIyR8UNSwunVsx6xd2eaL
LF1tV4nVkTTkSXqKdMerlwnSCfm5H6W5/hmrZiTrxcuGmamrKYNER2l8gAuPV3PO
J3W8LA7U/V2LEE8Uez0PSzgZW7+ZgnKU2E8/x7HmkgAbIDXqmjrMtKVKwRlgC2gu
Pwe3jPHLSHO0wztVQ+OeXvqfe8cyGuUYGsdbW/oWJO0HsTWSOz6z3NzBh+r3qtz/
qFP+hFc9HNUModyWx3fODzXvm5kXWDDh2FYC8EV2tR0rwf7GOLlT43FL4lbhEOWl
4xHq26vg4GdO1AK9Huoyrhr2AOVhaNXgk4CxTgnNc86ciJO+OK9Qn77SJ/RilY/L
47suYdZxZzgzs29Bj+AF203+yzSk+DfZK6We59E86A2VkDpbX0gSCVqmss7GYpPz
rQv+nunIP0wR6/Uzw4d1mwSKMf6grDOaVbrxp6bUSHfrTC3tJkLzIUyh2k2FzGok
pxKZ85hlvrosawz+Q66SOgaBvp69qidf3ipJfjFPzjRfhhd+rKtk7aFjEKR9QSTg
pTgs4XcJ3OIQ3mFPQ6PVzrnA79ApHOyiNDONYFh6sCWUx5qDUQKCAQEA/kbT9HdY
hKQusiAx02/tGf5Ew1YUX0bQD/NnZO8OgrfK2bDb8HYHVtuZ+1yxY/apLP5KQ/18
hD8/GCvMV+RyZ876z02reCsaxaSGBvb0+DR/0SFjkxvA1LbIE6mdoYwK0+cctBpP
RQ9Paj+82i8372IY+DKu25pN89FABZc/YOIHkJWlkkHLcnEu4983qupfnDWjYugJ
Kb3ZrgdmwCY3g91p/pR/Ltj7nZA873u9X5/t3A8aQXcFRqltXk2QwOqeLy/RdsOL
zhU7tqiOR9vLDAWOUTmY91Q3CMYQHKrrarWqKmeCetr2xqC4aE1LMk2EDc8HcM/c
HBoXkCADCco6mQKCAQEA9xyuEjzb9OANSrFYplLRdfxIyehkoWp5D3RVDrTjm7l5
z28tCE+YlkHdIueeDPNvl5AQskeVSn8IyKtTSMM1Xb5m69qSdjyUuVl2TmJCwLHU
ykIHa7SOFJjvhxBkL9T/q0JvajQtDvvQ3ar81nD6xXRyzZA9FA5taMmEOMPK6upL
A4wHIwFkeoN0zEO2iHFCZiL33DP4geAWwuMYL2sS386Dn8/mlw6RUsFJQfYKEW02
r108kG8PnZIqlqMePdCbByh8YY0uhC0kQG+0+q+OXUMvSEY67RY1xFoxB5s5PBFd
bsI2HlGDnORjB4/jso7NV9pMuMgx1avX98GjRIoIswKCAQBUiP+WWscW8e6EUae+
/4r4BUyfFFMZidVKOEW7jK5qTuglj2LPgq3V9pQuuRZQgYSk7LWL/Q4UeWJkissY
vV47nNhNaykCfnIcGyJj1l6C1hFYWZ1dHvDwxwOlZdJ+Dqza3g7w4X5RG1HvpNkI
QIJ8F0Tt3wu6/oXD9WEveqUbdInHS7kL8svMdEx+fYtoSxsWN87l5vaE5hUkgllq
sEnskQPYG05dKM4eCAH6LE09KVJOwsab1RHv+AvgOjFRsa59SYx9y20DSpPbmhYT
VcMfcAlsf5WXRGw3goGAxmIVy+eSyW7boUhBqNUl9+x0AMlSPe3fV3t57ELBK6NW
8eChAoIBAFxOsVOMull5zF1HbCcNLsNVD1ek4NpPLJOyUAejWJaWLUNoczj0irou
Nk3QmYCa+udx4FrIVKM0WvKi1QSMLwYqlsWpqyZRsPify4qyN99FToiTK7R3CM/2
5Rrd657WgP7XXUkd3msHc9kqAzKTl4lk23GgXMB+Ny56gFK4CLfB922GxC+2WHNP
YbTf4nKLZFNE4rO2EjFppPb9383uwGkr+o0bGzb4MR7pptTl9JLX6iKNwI7vfbTN
oe0NV8GdiBufav8BvwuO1UjgsYknRRXff+0OlvpzXnhPfJsrx7CBiBZUo+SlbHWR
9tAfVt4fa+NSX3BzD/KSM6WQBs4WhfMCggEAbO/nKXipPH1JeKw3dE86re1q6XdN
XNOSrT0n9ILjFQ7vAaMsC1vVnnqCVOQa2rHAqFRXMhBzEXnHA7FrLXUkB+pgaVzM
2ZZtrLp73Yqpu8BBbf/4T0U8ix87OciskZlX+W8eL9S/FAdCfV7Vy28hQedyqJp7
c/EgC1NTeS36HzNfzir52oY0wlL7w5EssqjNGLJ5VNXpiCjEZp8O1JDgR3XSLR3N
mw+WBMQ5Apoyzj06eN2UdvuWbDjRZ2Ky/NrRztrciMMS48TYt9hbNd6i+s2sg3CB
tc9qlMXiEK1BueysUWuxO7NWsK9IQi/gxYq+VT0gt1egX/CccLtnIblqSQ==
-----END RSA PRIVATE KEY-----

@pke
Copy link
Collaborator Author

pke commented Feb 26, 2021

While we are at it:

const decryptedBytes = await RNSimpleCrypto.RSA.decrypt(RNSimpleCrypto.utils.convertUtf8ToArrayBuffer(recipient.encryptedContent.content), privateKeyString)

Crashes the app. recipient.encryptedContent.content is a string with binary data from a decoded PKCS#7

The following is what I see on the console, but of course console tries to print in UTF-8 encoding.

[Fri Feb 26 2021 18:00:03.416]  LOG      recipient {"encryptedContent": {"algorithm": "1.2.840.113549.1.1.1", "content": ".¥uÀÜ´�5�èE&3ý®D�\�>°äßó:F+I¿ûxmX¬>qÌSF7þdÀ|õ\"çÇ�ó~>Ìêï×®eEö÷fê@�Ã�ÃÅÉ ãÛp¡C&1ѺºÉâ²l!�¢±ËË\\)
             Ti�c>+SÎR®ÌD�Á�Ï�÷�}�õÜ\\§ õÝ{ÄáÂî�SõÝa¢ÂD0�¯Ò�Ì_³¾Ñ̯Q_ÏN7ÍÚ�M�V¿
¶¹µûûÊ]ùVwvò%�
�aÂ9øòÓ�ùÏ¡7®DY6壬¡õçÆ�v.}Ûi'öí©
                                 �ôL«üSoª]èå¦W�È�a-^¹[²�-� -R
q�fª®FÏ�ê>ý�Íú{.ÐqÔ9h×$³%j¥´çv�»ñ�iÜÅâzN¾DÉ                  Úçñh,«=B�_D¹��¦a´Èõ¤»h¯ÔÇoÃc�¸zéú7nÏ��)�Ö\\
ìËù÷«®=¯f$äP��å¢ V*'¥ö¸:nÓ]ä\\jԣѨ£­~9¾Ð°vbSw�A¯>mJZ§�	p�zÚ×7!îi¡<�,Á-��¡_�$nÒ�¸åè1t±�ò«G¸¡µÄn½¢��Ûu¾¨ñ�Tî{2ºì·çª\\äµ�§uÒoamY{^8z:ö¢ïfµ"}

So in which representation should RSA.decrypt get its first argument?

@ghbutton
Copy link
Owner

ghbutton commented Mar 3, 2021

I think it is different for iOS / Android.
Both expect a hash with both public key and a private one.
iOS seems to encode in base64, Android uses an array buffer.
Are you trying to generate a set of public / private keys using some memory storage? We could try to create a function to format the keys properly given base64 public and private key input.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants