react-native-simple-crypto icon indicating copy to clipboard operation
react-native-simple-crypto copied to clipboard

Android RSA.decrypt also expects a base64 input

Open pke opened this issue 3 years ago • 8 comments

This can't be right?

image

https://github.com/ghbutton/react-native-simple-crypto/blob/c338e2e3367c7907fa84999d5f65182385a69ac2/android/src/main/java/com/pedrouid/crypto/RSA.java#L155

The RSA.decrypt and RSA.decrypt64 both threat input as base64. Shouldn't the non base64 version just take the input string without decoding it first?

pke avatar Feb 27 '21 00:02 pke

Yea that looks wrong

ghbutton avatar Feb 27 '21 03:02 ghbutton

Actually I am not sure, will try to dig in a little more.

ghbutton avatar Feb 27 '21 03:02 ghbutton

When we encrypt we store the intermediate as base64, which is why when we decrypt we assume the input is coming in as base64

ghbutton avatar Feb 27 '21 04:02 ghbutton

That's what a decrypt64 function would be for. Another scenario is that this lib is used only for decryption of data encrypted somewhere else. So a binary input would be preferable. Especially one that does not need conversion between JS/Native. Maybe using ArrayBuffer or UINT8? Couldn't find anything in the docu which datatype is simply mapped and has no transfer overhead.

pke avatar Feb 27 '21 17:02 pke

I think using ArrayBuffers everywhere would make more sense, or we could try to differentiate the input based on if it is a string or not similar to the SHA methods.

ghbutton avatar Mar 03 '21 15:03 ghbutton

I think ArrayBuffer would need no translation between native an JS, if I am correct? (The RN module docs are not the best).

pke avatar Mar 03 '21 22:03 pke

We have array buffers in other places, but we translate them to base64 in most cases. I dont think we can translate directly from javascript to native data types.

See: https://github.com/ghbutton/react-native-simple-crypto/blob/master/index.js#L76

ghbutton avatar Mar 04 '21 03:03 ghbutton

There is an undocumented WritableArray that we could use. I'll link it here later.

pke avatar Mar 04 '21 07:03 pke