saito-lite-rust icon indicating copy to clipboard operation
saito-lite-rust copied to clipboard

keychain.ts Warns that message failed decryption even when it succeeds

Open mat888 opened this issue 1 year ago • 0 comments

How I reproduce the issue:

mods/mymod.js

let newtx = await this.app.wallet.createUnsignedTransaction(publicKey);
                newtx.msg.data = "flat_string";

                newtx = await this.app.wallet.signAndEncryptTransaction(newtx, publicKey);
                this.app.network.propagateTransaction(newtx);

The culprit: https://github.com/SaitoTech/saito-lite-rust/blob/292118715bfc68a12de4d28fa84c6f60993b36bb/lib/saito/keychain.ts#L145

decryptMessage(publicKey: string, encrypted_msg) {
    // submit JSON parsed object after unencryption
    for (let x = 0; x < this.keys.length; x++) {
      if (this.keys[x].publicKey === publicKey) {
        if (this.keys[x].aes_secret) {
          console.log(encrypted_msg, "------>");
          const tmpmsg = this.app.crypto.aesDecrypt(encrypted_msg, this.keys[x].aes_secret);
          if (tmpmsg != null) {
            console.log(tmpmsg);
            const tmpx = JSON.parse(tmpmsg);
            if (tmpx.module != null) {
              return tmpx;
            }
          } 
        }
      }
    }
    console.log("Key not found, cannot decrypt");
    // or return original
    return encrypted_msg;
  }

The console happily shows the encrypted message, then the decrypted message. But because JSON.parse(tmpmsg) fails, the console issues the confusing warning "Key not found, cannot decrypt".

Since this involves some of the most sensitive operations (user privacy), this message may lead careful developers to believe their code is failing to secure communications when in fact it is. It can also falsely indicates that a shared secret doesn't exist when it does.

mat888 avatar Dec 09 '23 08:12 mat888