saito-lite-rust
saito-lite-rust copied to clipboard
keychain.ts Warns that message failed decryption even when it succeeds
How I reproduce the issue:
mods/mymod.js
let newtx = await this.app.wallet.createUnsignedTransaction(publicKey);
newtx.msg.data = "flat_string";
newtx = await this.app.wallet.signAndEncryptTransaction(newtx, publicKey);
this.app.network.propagateTransaction(newtx);
The culprit: https://github.com/SaitoTech/saito-lite-rust/blob/292118715bfc68a12de4d28fa84c6f60993b36bb/lib/saito/keychain.ts#L145
decryptMessage(publicKey: string, encrypted_msg) {
// submit JSON parsed object after unencryption
for (let x = 0; x < this.keys.length; x++) {
if (this.keys[x].publicKey === publicKey) {
if (this.keys[x].aes_secret) {
console.log(encrypted_msg, "------>");
const tmpmsg = this.app.crypto.aesDecrypt(encrypted_msg, this.keys[x].aes_secret);
if (tmpmsg != null) {
console.log(tmpmsg);
const tmpx = JSON.parse(tmpmsg);
if (tmpx.module != null) {
return tmpx;
}
}
}
}
}
console.log("Key not found, cannot decrypt");
// or return original
return encrypted_msg;
}
The console happily shows the encrypted message, then the decrypted message. But because JSON.parse(tmpmsg) fails, the console issues the confusing warning "Key not found, cannot decrypt"
.
Since this involves some of the most sensitive operations (user privacy), this message may lead careful developers to believe their code is failing to secure communications when in fact it is. It can also falsely indicates that a shared secret doesn't exist when it does.