2015-12-09 04:35:05 +01:00
|
|
|
angular
|
|
|
|
.module('bit.services')
|
|
|
|
|
2017-07-09 05:41:02 +02:00
|
|
|
.factory('cryptoService', function ($sessionStorage, constants, $q, $window) {
|
2015-12-09 04:35:05 +01:00
|
|
|
var _service = {},
|
|
|
|
_key,
|
2017-05-31 16:25:25 +02:00
|
|
|
_encKey,
|
2017-04-19 22:45:16 +02:00
|
|
|
_legacyEtmKey,
|
2017-04-19 04:28:49 +02:00
|
|
|
_orgKeys,
|
2017-02-28 06:18:11 +01:00
|
|
|
_privateKey,
|
2017-07-09 05:41:02 +02:00
|
|
|
_publicKey,
|
2017-07-09 05:48:08 +02:00
|
|
|
_crypto = typeof $window.crypto != 'undefined' ? $window.crypto : null,
|
|
|
|
_subtle = (!!_crypto && typeof $window.crypto.subtle != 'undefined') ? $window.crypto.subtle : null;
|
2015-12-09 04:35:05 +01:00
|
|
|
|
|
|
|
_service.setKey = function (key) {
|
|
|
|
_key = key;
|
2017-04-19 04:28:49 +02:00
|
|
|
$sessionStorage.key = _key.keyB64;
|
2015-12-09 04:35:05 +01:00
|
|
|
};
|
|
|
|
|
2017-05-31 18:21:06 +02:00
|
|
|
_service.setEncKey = function (encKey, key, alreadyDecrypted) {
|
|
|
|
if (alreadyDecrypted) {
|
|
|
|
_encKey = encKey;
|
|
|
|
$sessionStorage.encKey = _encKey.keyB64;
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
2017-05-31 16:25:25 +02:00
|
|
|
try {
|
2017-05-31 18:21:06 +02:00
|
|
|
var encKeyBytes = _service.decrypt(encKey, key, 'raw');
|
2017-05-31 16:25:25 +02:00
|
|
|
$sessionStorage.encKey = forge.util.encode64(encKeyBytes);
|
|
|
|
_encKey = new SymmetricCryptoKey(encKeyBytes);
|
|
|
|
}
|
|
|
|
catch (e) {
|
|
|
|
console.log('Cannot set enc key. Decryption failed.');
|
|
|
|
}
|
|
|
|
};
|
|
|
|
|
2017-02-21 06:29:15 +01:00
|
|
|
_service.setPrivateKey = function (privateKeyCt, key) {
|
|
|
|
try {
|
2017-03-10 02:59:10 +01:00
|
|
|
var privateKeyBytes = _service.decrypt(privateKeyCt, key, 'raw');
|
|
|
|
$sessionStorage.privateKey = forge.util.encode64(privateKeyBytes);
|
2017-03-22 04:07:38 +01:00
|
|
|
_privateKey = forge.pki.privateKeyFromAsn1(forge.asn1.fromDer(privateKeyBytes));
|
2017-02-21 06:29:15 +01:00
|
|
|
}
|
|
|
|
catch (e) {
|
|
|
|
console.log('Cannot set private key. Decryption failed.');
|
|
|
|
}
|
2017-02-21 04:21:14 +01:00
|
|
|
};
|
|
|
|
|
2017-03-07 05:54:06 +01:00
|
|
|
_service.setOrgKeys = function (orgKeysCt, privateKey) {
|
2017-03-28 04:22:56 +02:00
|
|
|
if (!orgKeysCt || Object.keys(orgKeysCt).length === 0) {
|
2017-03-07 05:54:06 +01:00
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
2017-04-02 04:17:28 +02:00
|
|
|
_service.clearOrgKeys();
|
2017-03-07 05:54:06 +01:00
|
|
|
var orgKeysb64 = {},
|
2017-03-14 03:54:57 +01:00
|
|
|
_orgKeys = {},
|
|
|
|
setKey = false;
|
2017-03-28 03:55:39 +02:00
|
|
|
|
|
|
|
for (var orgId in orgKeysCt) {
|
|
|
|
if (orgKeysCt.hasOwnProperty(orgId)) {
|
|
|
|
try {
|
2017-04-19 15:27:38 +02:00
|
|
|
var decBytes = _service.rsaDecrypt(orgKeysCt[orgId].key, privateKey);
|
2017-04-22 20:39:40 +02:00
|
|
|
var decKey = new SymmetricCryptoKey(decBytes);
|
2017-04-19 15:27:38 +02:00
|
|
|
_orgKeys[orgId] = decKey;
|
|
|
|
orgKeysb64[orgId] = decKey.keyB64;
|
2017-03-28 03:55:39 +02:00
|
|
|
setKey = true;
|
|
|
|
}
|
|
|
|
catch (e) {
|
2017-05-31 17:05:52 +02:00
|
|
|
console.log('Cannot set org key for ' + orgId + '. Decryption failed.');
|
2017-03-28 03:55:39 +02:00
|
|
|
}
|
2017-03-07 05:54:06 +01:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2017-03-14 03:54:57 +01:00
|
|
|
if (setKey) {
|
|
|
|
$sessionStorage.orgKeys = orgKeysb64;
|
|
|
|
}
|
|
|
|
else {
|
|
|
|
_orgKeys = null;
|
|
|
|
}
|
2017-03-12 02:46:33 +01:00
|
|
|
};
|
|
|
|
|
2017-04-03 15:30:21 +02:00
|
|
|
_service.addOrgKey = function (orgId, encOrgKey, privateKey) {
|
2017-03-12 02:46:33 +01:00
|
|
|
_orgKeys = _service.getOrgKeys();
|
|
|
|
if (!_orgKeys) {
|
|
|
|
_orgKeys = {};
|
|
|
|
}
|
|
|
|
|
|
|
|
var orgKeysb64 = $sessionStorage.orgKeys;
|
|
|
|
if (!orgKeysb64) {
|
|
|
|
orgKeysb64 = {};
|
|
|
|
}
|
|
|
|
|
|
|
|
try {
|
2017-04-19 15:27:38 +02:00
|
|
|
var decBytes = _service.rsaDecrypt(encOrgKey, privateKey);
|
2017-04-22 20:39:40 +02:00
|
|
|
var decKey = new SymmetricCryptoKey(decBytes);
|
2017-04-19 15:27:38 +02:00
|
|
|
_orgKeys[orgId] = decKey;
|
|
|
|
orgKeysb64[orgId] = decKey.keyB64;
|
2017-03-12 02:46:33 +01:00
|
|
|
}
|
|
|
|
catch (e) {
|
2017-03-14 03:54:57 +01:00
|
|
|
_orgKeys = null;
|
2017-03-12 02:46:33 +01:00
|
|
|
console.log('Cannot set org key. Decryption failed.');
|
|
|
|
}
|
2017-03-07 05:54:06 +01:00
|
|
|
|
|
|
|
$sessionStorage.orgKeys = orgKeysb64;
|
|
|
|
};
|
|
|
|
|
2017-04-19 04:28:49 +02:00
|
|
|
_service.getKey = function () {
|
|
|
|
if (!_key && $sessionStorage.key) {
|
2017-04-22 20:39:40 +02:00
|
|
|
_key = new SymmetricCryptoKey($sessionStorage.key, true);
|
2015-12-09 04:35:05 +01:00
|
|
|
}
|
|
|
|
|
2017-04-19 04:28:49 +02:00
|
|
|
if (!_key) {
|
|
|
|
throw 'key unavailable';
|
2015-12-09 04:35:05 +01:00
|
|
|
}
|
|
|
|
|
|
|
|
return _key;
|
|
|
|
};
|
|
|
|
|
2017-05-31 16:25:25 +02:00
|
|
|
_service.getEncKey = function () {
|
|
|
|
if (!_encKey && $sessionStorage.encKey) {
|
|
|
|
_encKey = new SymmetricCryptoKey($sessionStorage.encKey, true);
|
|
|
|
}
|
|
|
|
|
|
|
|
return _encKey;
|
|
|
|
};
|
|
|
|
|
2017-04-17 20:53:26 +02:00
|
|
|
_service.getPrivateKey = function (outputEncoding) {
|
|
|
|
outputEncoding = outputEncoding || 'native';
|
|
|
|
|
2017-02-21 04:21:14 +01:00
|
|
|
if (_privateKey) {
|
2017-04-17 20:53:26 +02:00
|
|
|
if (outputEncoding === 'raw') {
|
|
|
|
var privateKeyAsn1 = forge.pki.privateKeyToAsn1(_privateKey);
|
|
|
|
var privateKeyPkcs8 = forge.pki.wrapRsaPrivateKey(privateKeyAsn1);
|
|
|
|
return forge.asn1.toDer(privateKeyPkcs8).getBytes();
|
|
|
|
}
|
|
|
|
|
2017-02-21 04:21:14 +01:00
|
|
|
return _privateKey;
|
|
|
|
}
|
|
|
|
|
|
|
|
if ($sessionStorage.privateKey) {
|
2017-02-28 06:18:11 +01:00
|
|
|
var privateKeyBytes = forge.util.decode64($sessionStorage.privateKey);
|
|
|
|
_privateKey = forge.pki.privateKeyFromAsn1(forge.asn1.fromDer(privateKeyBytes));
|
2017-04-17 20:53:26 +02:00
|
|
|
|
|
|
|
if (outputEncoding === 'raw') {
|
|
|
|
return privateKeyBytes;
|
|
|
|
}
|
2017-02-21 04:21:14 +01:00
|
|
|
}
|
|
|
|
|
|
|
|
return _privateKey;
|
|
|
|
};
|
|
|
|
|
2017-02-28 06:18:11 +01:00
|
|
|
_service.getPublicKey = function () {
|
|
|
|
if (_publicKey) {
|
|
|
|
return _publicKey;
|
|
|
|
}
|
|
|
|
|
|
|
|
var privateKey = _service.getPrivateKey();
|
|
|
|
if (!privateKey) {
|
|
|
|
return null;
|
|
|
|
}
|
|
|
|
|
|
|
|
_publicKey = forge.pki.setRsaPublicKey(privateKey.n, privateKey.e);
|
|
|
|
return _publicKey;
|
|
|
|
};
|
|
|
|
|
2017-03-07 05:54:06 +01:00
|
|
|
_service.getOrgKeys = function () {
|
|
|
|
if (_orgKeys) {
|
|
|
|
return _orgKeys;
|
|
|
|
}
|
|
|
|
|
|
|
|
if ($sessionStorage.orgKeys) {
|
2017-03-10 04:28:14 +01:00
|
|
|
var orgKeys = {},
|
|
|
|
setKey = false;
|
|
|
|
|
2017-03-07 05:54:06 +01:00
|
|
|
for (var orgId in $sessionStorage.orgKeys) {
|
|
|
|
if ($sessionStorage.orgKeys.hasOwnProperty(orgId)) {
|
2017-04-22 20:39:40 +02:00
|
|
|
orgKeys[orgId] = new SymmetricCryptoKey($sessionStorage.orgKeys[orgId], true);
|
2017-03-10 04:28:14 +01:00
|
|
|
setKey = true;
|
2017-03-07 05:54:06 +01:00
|
|
|
}
|
|
|
|
}
|
2017-03-10 04:28:14 +01:00
|
|
|
|
|
|
|
if (setKey) {
|
|
|
|
_orgKeys = orgKeys;
|
|
|
|
}
|
2017-03-07 05:54:06 +01:00
|
|
|
}
|
|
|
|
|
|
|
|
return _orgKeys;
|
|
|
|
};
|
|
|
|
|
|
|
|
_service.getOrgKey = function (orgId) {
|
|
|
|
var orgKeys = _service.getOrgKeys();
|
|
|
|
if (!orgKeys || !(orgId in orgKeys)) {
|
|
|
|
return null;
|
|
|
|
}
|
|
|
|
|
|
|
|
return orgKeys[orgId];
|
2017-03-22 04:07:38 +01:00
|
|
|
};
|
2017-03-07 05:54:06 +01:00
|
|
|
|
2015-12-09 04:35:05 +01:00
|
|
|
_service.clearKey = function () {
|
2017-04-19 04:28:49 +02:00
|
|
|
_key = null;
|
2017-04-19 22:45:16 +02:00
|
|
|
_legacyEtmKey = null;
|
2015-12-09 04:35:05 +01:00
|
|
|
delete $sessionStorage.key;
|
|
|
|
};
|
|
|
|
|
2017-05-31 16:25:25 +02:00
|
|
|
_service.clearEncKey = function () {
|
|
|
|
_encKey = null;
|
|
|
|
delete $sessionStorage.encKey;
|
|
|
|
};
|
|
|
|
|
2017-02-28 06:18:11 +01:00
|
|
|
_service.clearKeyPair = function () {
|
2017-02-21 04:21:14 +01:00
|
|
|
_privateKey = null;
|
2017-02-28 06:18:11 +01:00
|
|
|
_publicKey = null;
|
2017-02-21 04:21:14 +01:00
|
|
|
delete $sessionStorage.privateKey;
|
|
|
|
};
|
|
|
|
|
2017-03-07 05:54:06 +01:00
|
|
|
_service.clearOrgKeys = function () {
|
2017-03-14 03:54:57 +01:00
|
|
|
_orgKeys = null;
|
2017-03-07 05:54:06 +01:00
|
|
|
delete $sessionStorage.orgKeys;
|
|
|
|
};
|
|
|
|
|
2017-04-11 16:52:16 +02:00
|
|
|
_service.clearOrgKey = function (orgId) {
|
|
|
|
if (_orgKeys.hasOwnProperty(orgId)) {
|
|
|
|
delete _orgKeys[orgId];
|
|
|
|
}
|
|
|
|
|
|
|
|
if ($sessionStorage.orgKeys.hasOwnProperty(orgId)) {
|
|
|
|
delete $sessionStorage.orgKeys[orgId];
|
|
|
|
}
|
|
|
|
};
|
|
|
|
|
2017-02-21 04:21:14 +01:00
|
|
|
_service.clearKeys = function () {
|
|
|
|
_service.clearKey();
|
2017-05-31 16:25:25 +02:00
|
|
|
_service.clearEncKey();
|
2017-02-28 06:18:11 +01:00
|
|
|
_service.clearKeyPair();
|
2017-03-07 05:54:06 +01:00
|
|
|
_service.clearOrgKeys();
|
2017-02-21 04:21:14 +01:00
|
|
|
};
|
|
|
|
|
2017-04-19 04:28:49 +02:00
|
|
|
_service.makeKey = function (password, salt) {
|
2017-07-09 06:23:26 +02:00
|
|
|
if (!$window.cryptoShimmed && $window.navigator.userAgent.indexOf('Edge') === -1) {
|
2017-07-09 05:41:02 +02:00
|
|
|
return pbkdf2WC(password, salt, 5000, 256).then(function (keyBuf) {
|
|
|
|
return new SymmetricCryptoKey(bufToB64(keyBuf), true);
|
|
|
|
});
|
|
|
|
}
|
|
|
|
else {
|
|
|
|
var deferred = $q.defer();
|
|
|
|
var keyBytes = forge.pbkdf2(forge.util.encodeUtf8(password), forge.util.encodeUtf8(salt),
|
|
|
|
5000, 256 / 8, 'sha256');
|
|
|
|
deferred.resolve(new SymmetricCryptoKey(keyBytes));
|
|
|
|
return deferred.promise;
|
|
|
|
}
|
2015-12-09 04:35:05 +01:00
|
|
|
};
|
|
|
|
|
2017-05-31 17:05:52 +02:00
|
|
|
_service.makeEncKey = function (key) {
|
|
|
|
var encKey = forge.random.getBytesSync(512 / 8);
|
|
|
|
var encKeyEnc = _service.encrypt(encKey, key, 'raw');
|
|
|
|
return {
|
|
|
|
encKey: new SymmetricCryptoKey(encKey),
|
|
|
|
encKeyEnc: encKeyEnc
|
|
|
|
};
|
|
|
|
};
|
|
|
|
|
2017-04-14 00:18:32 +02:00
|
|
|
_service.makeKeyPair = function (key) {
|
|
|
|
var deferred = $q.defer();
|
|
|
|
|
2017-05-16 02:58:16 +02:00
|
|
|
forge.pki.rsa.generateKeyPair({
|
|
|
|
bits: 2048,
|
|
|
|
workers: 2,
|
|
|
|
workerScript: '/lib/forge/prime.worker.min.js'
|
|
|
|
}, function (error, keypair) {
|
2017-02-21 04:21:14 +01:00
|
|
|
if (error) {
|
2017-04-14 00:18:32 +02:00
|
|
|
deferred.reject(error);
|
2017-02-21 04:21:14 +01:00
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
2017-03-11 02:49:50 +01:00
|
|
|
var privateKeyAsn1 = forge.pki.privateKeyToAsn1(keypair.privateKey);
|
|
|
|
var privateKeyPkcs8 = forge.pki.wrapRsaPrivateKey(privateKeyAsn1);
|
|
|
|
var privateKeyBytes = forge.asn1.toDer(privateKeyPkcs8).getBytes();
|
2017-04-14 00:18:32 +02:00
|
|
|
var privateKeyEncCt = _service.encrypt(privateKeyBytes, key, 'raw');
|
2017-02-21 04:21:14 +01:00
|
|
|
|
2017-03-11 02:49:50 +01:00
|
|
|
var publicKeyAsn1 = forge.pki.publicKeyToAsn1(keypair.publicKey);
|
|
|
|
var publicKeyBytes = forge.asn1.toDer(publicKeyAsn1).getBytes();
|
2017-02-21 04:21:14 +01:00
|
|
|
|
2017-04-14 00:18:32 +02:00
|
|
|
deferred.resolve({
|
|
|
|
publicKey: forge.util.encode64(publicKeyBytes),
|
|
|
|
privateKeyEnc: privateKeyEncCt
|
|
|
|
});
|
2017-02-21 04:21:14 +01:00
|
|
|
});
|
2017-04-14 00:18:32 +02:00
|
|
|
|
|
|
|
return deferred.promise;
|
2017-02-21 04:21:14 +01:00
|
|
|
};
|
|
|
|
|
2017-04-19 04:28:49 +02:00
|
|
|
_service.makeShareKeyCt = function () {
|
2017-06-19 16:00:42 +02:00
|
|
|
return _service.rsaEncryptMe(forge.random.getBytesSync(512 / 8));
|
2017-02-28 06:18:11 +01:00
|
|
|
};
|
|
|
|
|
2015-12-09 04:35:05 +01:00
|
|
|
_service.hashPassword = function (password, key) {
|
|
|
|
if (!key) {
|
|
|
|
key = _service.getKey();
|
|
|
|
}
|
|
|
|
|
|
|
|
if (!password || !key) {
|
|
|
|
throw 'Invalid parameters.';
|
|
|
|
}
|
|
|
|
|
2017-07-09 06:23:26 +02:00
|
|
|
if (!$window.cryptoShimmed && $window.navigator.userAgent.indexOf('Edge') === -1) {
|
2017-07-09 05:41:02 +02:00
|
|
|
var keyBuf = key.getBuffers();
|
|
|
|
return pbkdf2WC(new Uint8Array(keyBuf.key), password, 1, 256).then(function (hashBuf) {
|
|
|
|
return bufToB64(hashBuf);
|
|
|
|
});
|
|
|
|
}
|
|
|
|
else {
|
|
|
|
var deferred = $q.defer();
|
|
|
|
var hashBits = forge.pbkdf2(key.key, forge.util.encodeUtf8(password), 1, 256 / 8, 'sha256');
|
|
|
|
deferred.resolve(forge.util.encode64(hashBits));
|
|
|
|
return deferred.promise;
|
|
|
|
}
|
|
|
|
};
|
|
|
|
|
|
|
|
function pbkdf2WC(password, salt, iterations, size) {
|
|
|
|
password = typeof (password) === 'string' ? utf8ToArray(password) : password;
|
|
|
|
salt = typeof (salt) === 'string' ? utf8ToArray(salt) : salt;
|
|
|
|
|
|
|
|
return _subtle.importKey('raw', password.buffer, { name: 'PBKDF2' }, false, ['deriveKey', 'deriveBits'])
|
|
|
|
.then(function (importedKey) {
|
|
|
|
return _subtle.deriveKey(
|
|
|
|
{ name: 'PBKDF2', salt: salt.buffer, iterations: iterations, hash: { name: 'SHA-256' } },
|
|
|
|
importedKey, { name: 'AES-CBC', length: size }, true, ['encrypt', 'decrypt']);
|
|
|
|
}).then(function (derivedKey) {
|
|
|
|
return _subtle.exportKey('raw', derivedKey);
|
|
|
|
});
|
|
|
|
}
|
|
|
|
|
|
|
|
_service.makeKeyAndHash = function (email, password) {
|
|
|
|
email = email.toLowerCase();
|
|
|
|
var key;
|
|
|
|
return _service.makeKey(password, email).then(function (theKey) {
|
|
|
|
key = theKey;
|
|
|
|
return _service.hashPassword(password, theKey);
|
|
|
|
}).then(function (theHash) {
|
|
|
|
return {
|
|
|
|
key: key,
|
|
|
|
hash: theHash
|
|
|
|
};
|
|
|
|
});
|
2016-12-09 04:21:46 +01:00
|
|
|
};
|
|
|
|
|
2017-02-21 06:29:15 +01:00
|
|
|
_service.encrypt = function (plainValue, key, plainValueEncoding) {
|
2017-06-30 22:22:39 +02:00
|
|
|
var encValue = aesEncrypt(plainValue, key, plainValueEncoding);
|
|
|
|
|
|
|
|
var iv = forge.util.encode64(encValue.iv);
|
|
|
|
var ct = forge.util.encode64(encValue.ct);
|
|
|
|
var cipherString = iv + '|' + ct;
|
|
|
|
|
|
|
|
if (encValue.mac) {
|
2017-07-14 20:32:01 +02:00
|
|
|
var mac = forge.util.encode64(encValue.mac);
|
2017-06-30 22:22:39 +02:00
|
|
|
cipherString = cipherString + '|' + mac;
|
|
|
|
}
|
|
|
|
|
|
|
|
return encValue.key.encType + '.' + cipherString;
|
|
|
|
};
|
|
|
|
|
|
|
|
_service.encryptToBytes = function (plainValue, key) {
|
|
|
|
return aesEncryptWC(plainValue, key).then(function (encValue) {
|
|
|
|
var macLen = 0;
|
|
|
|
if (encValue.mac) {
|
2017-07-14 20:32:01 +02:00
|
|
|
macLen = encValue.mac.length;
|
2017-06-30 22:22:39 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
var encBytes = new Uint8Array(1 + encValue.iv.length + macLen + encValue.ct.length);
|
|
|
|
|
|
|
|
encBytes.set([encValue.key.encType]);
|
|
|
|
encBytes.set(encValue.iv, 1);
|
|
|
|
if (encValue.mac) {
|
|
|
|
encBytes.set(encValue.mac, 1 + encValue.iv.length);
|
|
|
|
}
|
|
|
|
encBytes.set(encValue.ct, 1 + encValue.iv.length + macLen);
|
|
|
|
|
|
|
|
return encBytes.buffer;
|
|
|
|
});
|
|
|
|
};
|
|
|
|
|
|
|
|
function aesEncrypt(plainValue, key, plainValueEncoding) {
|
2017-05-31 16:25:25 +02:00
|
|
|
key = key || _service.getEncKey() || _service.getKey();
|
2015-12-09 04:35:05 +01:00
|
|
|
|
2017-04-19 04:28:49 +02:00
|
|
|
if (!key) {
|
|
|
|
throw 'Encryption key unavailable.';
|
2015-12-09 04:35:05 +01:00
|
|
|
}
|
|
|
|
|
2017-02-21 06:29:15 +01:00
|
|
|
plainValueEncoding = plainValueEncoding || 'utf8';
|
|
|
|
var buffer = forge.util.createBuffer(plainValue, plainValueEncoding);
|
2017-02-11 19:03:48 +01:00
|
|
|
var ivBytes = forge.random.getBytesSync(16);
|
2017-04-19 04:28:49 +02:00
|
|
|
var cipher = forge.cipher.createCipher('AES-CBC', key.encKey);
|
2017-02-11 19:03:48 +01:00
|
|
|
cipher.start({ iv: ivBytes });
|
|
|
|
cipher.update(buffer);
|
|
|
|
cipher.finish();
|
2015-12-09 04:35:05 +01:00
|
|
|
|
2017-02-11 19:03:48 +01:00
|
|
|
var ctBytes = cipher.output.getBytes();
|
2016-12-09 04:21:46 +01:00
|
|
|
|
2017-06-30 22:22:39 +02:00
|
|
|
var macBytes = null;
|
2017-04-19 04:28:49 +02:00
|
|
|
if (key.macKey) {
|
2017-06-30 22:22:39 +02:00
|
|
|
macBytes = computeMac(ivBytes + ctBytes, key.macKey, false);
|
2016-12-09 04:21:46 +01:00
|
|
|
}
|
|
|
|
|
2017-06-30 22:22:39 +02:00
|
|
|
return {
|
|
|
|
iv: ivBytes,
|
|
|
|
ct: ctBytes,
|
|
|
|
mac: macBytes,
|
|
|
|
key: key,
|
|
|
|
plainValueEncoding: plainValueEncoding
|
|
|
|
};
|
|
|
|
}
|
|
|
|
|
|
|
|
function aesEncryptWC(plainValue, key) {
|
|
|
|
key = key || _service.getEncKey() || _service.getKey();
|
|
|
|
|
|
|
|
if (!key) {
|
|
|
|
throw 'Encryption key unavailable.';
|
|
|
|
}
|
|
|
|
|
|
|
|
var obj = {
|
|
|
|
iv: new Uint8Array(16),
|
|
|
|
ct: null,
|
|
|
|
mac: null,
|
|
|
|
key: key
|
|
|
|
};
|
|
|
|
|
|
|
|
var keyBuf = key.getBuffers();
|
2017-07-09 05:41:02 +02:00
|
|
|
_crypto.getRandomValues(obj.iv);
|
2017-06-30 22:22:39 +02:00
|
|
|
|
2017-07-09 05:41:02 +02:00
|
|
|
return _subtle.importKey('raw', keyBuf.encKey, { name: 'AES-CBC' }, false, ['encrypt'])
|
2017-06-30 22:22:39 +02:00
|
|
|
.then(function (encKey) {
|
2017-07-09 05:41:02 +02:00
|
|
|
return _subtle.encrypt({ name: 'AES-CBC', iv: obj.iv }, encKey, plainValue);
|
2017-06-30 22:22:39 +02:00
|
|
|
}).then(function (encValue) {
|
|
|
|
obj.ct = new Uint8Array(encValue);
|
|
|
|
if (!keyBuf.macKey) {
|
|
|
|
return null;
|
|
|
|
}
|
2017-07-01 04:34:26 +02:00
|
|
|
|
|
|
|
var data = new Uint8Array(obj.iv.length + obj.ct.length);
|
|
|
|
data.set(obj.iv, 0);
|
|
|
|
data.set(obj.ct, obj.iv.length);
|
|
|
|
return computeMacWC(data.buffer, keyBuf.macKey);
|
2017-06-30 22:22:39 +02:00
|
|
|
}).then(function (mac) {
|
|
|
|
if (mac) {
|
|
|
|
obj.mac = new Uint8Array(mac);
|
|
|
|
}
|
|
|
|
return obj;
|
|
|
|
});
|
|
|
|
}
|
2015-12-09 04:35:05 +01:00
|
|
|
|
2017-06-19 16:00:42 +02:00
|
|
|
_service.rsaEncrypt = function (plainValue, publicKey, key) {
|
2017-02-28 06:18:11 +01:00
|
|
|
publicKey = publicKey || _service.getPublicKey();
|
|
|
|
if (!publicKey) {
|
|
|
|
throw 'Public key unavailable.';
|
|
|
|
}
|
|
|
|
|
2017-03-05 02:41:45 +01:00
|
|
|
if (typeof publicKey === 'string') {
|
|
|
|
var publicKeyBytes = forge.util.decode64(publicKey);
|
|
|
|
publicKey = forge.pki.publicKeyFromAsn1(forge.asn1.fromDer(publicKeyBytes));
|
|
|
|
}
|
|
|
|
|
2017-02-28 06:18:11 +01:00
|
|
|
var encryptedBytes = publicKey.encrypt(plainValue, 'RSA-OAEP', {
|
2017-04-21 19:46:07 +02:00
|
|
|
md: forge.md.sha1.create()
|
2017-02-28 06:18:11 +01:00
|
|
|
});
|
2017-06-19 16:00:42 +02:00
|
|
|
var cipherString = forge.util.encode64(encryptedBytes);
|
2017-04-19 04:28:49 +02:00
|
|
|
|
2017-06-19 16:00:42 +02:00
|
|
|
if (key && key.macKey) {
|
|
|
|
var mac = computeMac(encryptedBytes, key.macKey, true);
|
|
|
|
return constants.encType.Rsa2048_OaepSha1_HmacSha256_B64 + '.' + cipherString + '|' + mac;
|
|
|
|
}
|
|
|
|
else {
|
|
|
|
return constants.encType.Rsa2048_OaepSha1_B64 + '.' + cipherString;
|
|
|
|
}
|
2017-03-01 04:53:19 +01:00
|
|
|
};
|
2017-02-28 06:18:11 +01:00
|
|
|
|
2017-06-19 16:00:42 +02:00
|
|
|
_service.rsaEncryptMe = function (plainValue) {
|
|
|
|
return _service.rsaEncrypt(plainValue, _service.getPublicKey(), _service.getEncKey());
|
2017-06-19 16:23:50 +02:00
|
|
|
};
|
2017-06-19 16:00:42 +02:00
|
|
|
|
2017-02-21 06:29:15 +01:00
|
|
|
_service.decrypt = function (encValue, key, outputEncoding) {
|
2017-08-01 05:19:02 +02:00
|
|
|
try {
|
|
|
|
key = key || _service.getEncKey() || _service.getKey();
|
2017-04-19 04:28:49 +02:00
|
|
|
|
2017-08-01 05:19:02 +02:00
|
|
|
var headerPieces = encValue.split('.'),
|
|
|
|
encType,
|
|
|
|
encPieces;
|
2017-04-07 05:00:33 +02:00
|
|
|
|
2017-08-01 05:19:02 +02:00
|
|
|
if (headerPieces.length === 2) {
|
|
|
|
try {
|
|
|
|
encType = parseInt(headerPieces[0]);
|
|
|
|
encPieces = headerPieces[1].split('|');
|
|
|
|
}
|
|
|
|
catch (e) {
|
|
|
|
console.error('Cannot parse headerPieces.');
|
|
|
|
return null;
|
|
|
|
}
|
2017-04-07 05:00:33 +02:00
|
|
|
}
|
2017-08-01 05:19:02 +02:00
|
|
|
else {
|
|
|
|
encPieces = encValue.split('|');
|
|
|
|
encType = encPieces.length === 3 ? constants.encType.AesCbc128_HmacSha256_B64 :
|
|
|
|
constants.encType.AesCbc256_B64;
|
2017-04-07 05:00:33 +02:00
|
|
|
}
|
2017-04-19 22:45:16 +02:00
|
|
|
|
2017-08-01 05:19:02 +02:00
|
|
|
if (encType === constants.encType.AesCbc128_HmacSha256_B64 && key.encType === constants.encType.AesCbc256_B64) {
|
|
|
|
// Old encrypt-then-mac scheme, swap out the key
|
|
|
|
_legacyEtmKey = _legacyEtmKey ||
|
|
|
|
new SymmetricCryptoKey(key.key, false, constants.encType.AesCbc128_HmacSha256_B64);
|
|
|
|
key = _legacyEtmKey;
|
|
|
|
}
|
2015-12-09 04:35:05 +01:00
|
|
|
|
2017-08-01 05:19:02 +02:00
|
|
|
if (encType !== key.encType) {
|
|
|
|
throw 'encType unavailable.';
|
|
|
|
}
|
2017-04-19 04:28:49 +02:00
|
|
|
|
2017-08-01 05:19:02 +02:00
|
|
|
switch (encType) {
|
|
|
|
case constants.encType.AesCbc128_HmacSha256_B64:
|
|
|
|
case constants.encType.AesCbc256_HmacSha256_B64:
|
|
|
|
if (encPieces.length !== 3) {
|
|
|
|
console.error('Enc type (' + encType + ') not valid.');
|
|
|
|
return null;
|
|
|
|
}
|
|
|
|
break;
|
|
|
|
case constants.encType.AesCbc256_B64:
|
|
|
|
if (encPieces.length !== 2) {
|
|
|
|
console.error('Enc type (' + encType + ') not valid.');
|
|
|
|
return null;
|
|
|
|
}
|
|
|
|
break;
|
|
|
|
default:
|
|
|
|
console.error('Enc type (' + encType + ') not supported.');
|
2017-04-07 05:00:33 +02:00
|
|
|
return null;
|
2017-08-01 05:19:02 +02:00
|
|
|
}
|
2017-04-07 05:00:33 +02:00
|
|
|
|
2017-08-01 05:19:02 +02:00
|
|
|
var ivBytes = forge.util.decode64(encPieces[0]);
|
|
|
|
var ctBytes = forge.util.decode64(encPieces[1]);
|
2015-12-09 04:35:05 +01:00
|
|
|
|
2017-08-01 05:19:02 +02:00
|
|
|
if (key.macKey && encPieces.length > 2) {
|
|
|
|
var macBytes = forge.util.decode64(encPieces[2]);
|
|
|
|
var computedMacBytes = computeMac(ivBytes + ctBytes, key.macKey, false);
|
|
|
|
if (!macsEqual(key.macKey, macBytes, computedMacBytes)) {
|
|
|
|
console.error('MAC failed.');
|
|
|
|
return null;
|
|
|
|
}
|
2016-12-09 04:21:46 +01:00
|
|
|
}
|
|
|
|
|
2017-08-01 05:19:02 +02:00
|
|
|
var ctBuffer = forge.util.createBuffer(ctBytes);
|
|
|
|
var decipher = forge.cipher.createDecipher('AES-CBC', key.encKey);
|
|
|
|
decipher.start({ iv: ivBytes });
|
|
|
|
decipher.update(ctBuffer);
|
|
|
|
decipher.finish();
|
2015-12-09 04:35:05 +01:00
|
|
|
|
2017-08-01 05:19:02 +02:00
|
|
|
outputEncoding = outputEncoding || 'utf8';
|
|
|
|
if (outputEncoding === 'utf8') {
|
|
|
|
return decipher.output.toString('utf8');
|
|
|
|
}
|
|
|
|
else {
|
|
|
|
return decipher.output.getBytes();
|
|
|
|
}
|
2017-02-21 04:21:14 +01:00
|
|
|
}
|
2017-08-01 05:19:02 +02:00
|
|
|
catch (e) {
|
|
|
|
console.error('Caught unhandled error in decrypt: ' + e);
|
|
|
|
throw e;
|
2017-02-21 04:21:14 +01:00
|
|
|
}
|
2017-02-11 19:03:48 +01:00
|
|
|
};
|
2016-12-09 04:21:46 +01:00
|
|
|
|
2017-07-01 04:34:26 +02:00
|
|
|
_service.decryptFromBytes = function (encBuf, key) {
|
2017-08-01 05:19:02 +02:00
|
|
|
try {
|
|
|
|
if (!encBuf) {
|
|
|
|
throw 'no encBuf.';
|
|
|
|
}
|
2017-07-01 04:34:26 +02:00
|
|
|
|
2017-08-01 05:19:02 +02:00
|
|
|
var encBytes = new Uint8Array(encBuf),
|
|
|
|
encType = encBytes[0],
|
|
|
|
ctBytes = null,
|
|
|
|
ivBytes = null,
|
|
|
|
macBytes = null;
|
|
|
|
|
|
|
|
switch (encType) {
|
|
|
|
case constants.encType.AesCbc128_HmacSha256_B64:
|
|
|
|
case constants.encType.AesCbc256_HmacSha256_B64:
|
|
|
|
if (encBytes.length <= 49) { // 1 + 16 + 32 + ctLength
|
|
|
|
console.error('Enc type (' + encType + ') not valid.');
|
|
|
|
return null;
|
|
|
|
}
|
|
|
|
|
|
|
|
ivBytes = slice(encBytes, 1, 17);
|
|
|
|
macBytes = slice(encBytes, 17, 49);
|
|
|
|
ctBytes = slice(encBytes, 49);
|
|
|
|
break;
|
|
|
|
case constants.encType.AesCbc256_B64:
|
|
|
|
if (encBytes.length <= 17) { // 1 + 16 + ctLength
|
|
|
|
console.error('Enc type (' + encType + ') not valid.');
|
|
|
|
return null;
|
|
|
|
}
|
|
|
|
|
|
|
|
ivBytes = slice(encBytes, 1, 17);
|
|
|
|
ctBytes = slice(encBytes, 17);
|
|
|
|
break;
|
|
|
|
default:
|
|
|
|
console.error('Enc type (' + encType + ') not supported.');
|
2017-07-01 04:34:26 +02:00
|
|
|
return null;
|
2017-08-01 05:19:02 +02:00
|
|
|
}
|
2017-07-01 04:34:26 +02:00
|
|
|
|
2017-08-01 05:19:02 +02:00
|
|
|
return aesDecryptWC(
|
|
|
|
encType,
|
|
|
|
ctBytes.buffer,
|
|
|
|
ivBytes.buffer,
|
|
|
|
macBytes ? macBytes.buffer : null,
|
|
|
|
key);
|
|
|
|
}
|
|
|
|
catch (e) {
|
|
|
|
console.error('Caught unhandled error in decryptFromBytes: ' + e);
|
|
|
|
throw e;
|
2017-07-01 04:34:26 +02:00
|
|
|
}
|
|
|
|
};
|
|
|
|
|
|
|
|
function aesDecryptWC(encType, ctBuf, ivBuf, macBuf, key) {
|
|
|
|
key = key || _service.getEncKey() || _service.getKey();
|
|
|
|
if (!key) {
|
|
|
|
throw 'Encryption key unavailable.';
|
|
|
|
}
|
|
|
|
|
2017-07-13 17:22:16 +02:00
|
|
|
if (encType !== key.encType) {
|
|
|
|
throw 'encType unavailable.';
|
|
|
|
}
|
|
|
|
|
2017-07-01 04:34:26 +02:00
|
|
|
var keyBuf = key.getBuffers(),
|
|
|
|
encKey = null;
|
|
|
|
|
2017-07-09 05:41:02 +02:00
|
|
|
return _subtle.importKey('raw', keyBuf.encKey, { name: 'AES-CBC' }, false, ['decrypt'])
|
2017-07-01 04:34:26 +02:00
|
|
|
.then(function (theEncKey) {
|
|
|
|
encKey = theEncKey;
|
|
|
|
|
|
|
|
if (!key.macKey || !macBuf) {
|
|
|
|
return null;
|
|
|
|
}
|
|
|
|
|
|
|
|
var data = new Uint8Array(ivBuf.byteLength + ctBuf.byteLength);
|
|
|
|
data.set(new Uint8Array(ivBuf), 0);
|
|
|
|
data.set(new Uint8Array(ctBuf), ivBuf.byteLength);
|
|
|
|
return computeMacWC(data.buffer, keyBuf.macKey);
|
|
|
|
}).then(function (computedMacBuf) {
|
|
|
|
if (computedMacBuf === null) {
|
|
|
|
return null;
|
|
|
|
}
|
|
|
|
return macsEqualWC(keyBuf.macKey, macBuf, computedMacBuf);
|
|
|
|
}).then(function (macsMatch) {
|
|
|
|
if (macsMatch === false) {
|
|
|
|
console.error('MAC failed.');
|
|
|
|
return null;
|
|
|
|
}
|
2017-07-09 05:41:02 +02:00
|
|
|
return _subtle.decrypt({ name: 'AES-CBC', iv: ivBuf }, encKey, ctBuf);
|
2017-07-01 04:34:26 +02:00
|
|
|
});
|
|
|
|
}
|
|
|
|
|
2017-06-19 16:00:42 +02:00
|
|
|
_service.rsaDecrypt = function (encValue, privateKey, key) {
|
2017-02-28 06:18:11 +01:00
|
|
|
privateKey = privateKey || _service.getPrivateKey();
|
2017-06-19 16:00:42 +02:00
|
|
|
key = key || _service.getEncKey();
|
|
|
|
|
2017-02-28 06:18:11 +01:00
|
|
|
if (!privateKey) {
|
|
|
|
throw 'Private key unavailable.';
|
|
|
|
}
|
|
|
|
|
2017-04-07 05:00:33 +02:00
|
|
|
var headerPieces = encValue.split('.'),
|
|
|
|
encType,
|
2017-06-19 16:00:42 +02:00
|
|
|
encPieces;
|
2017-04-07 05:00:33 +02:00
|
|
|
|
|
|
|
if (headerPieces.length === 1) {
|
2017-04-21 19:46:07 +02:00
|
|
|
encType = constants.encType.Rsa2048_OaepSha256_B64;
|
2017-06-19 16:00:42 +02:00
|
|
|
encPieces = [headerPieces[0]];
|
2017-04-07 05:00:33 +02:00
|
|
|
}
|
|
|
|
else if (headerPieces.length === 2) {
|
|
|
|
try {
|
|
|
|
encType = parseInt(headerPieces[0]);
|
2017-06-19 16:00:42 +02:00
|
|
|
encPieces = headerPieces[1].split('|');
|
2017-04-07 05:00:33 +02:00
|
|
|
}
|
|
|
|
catch (e) {
|
|
|
|
return null;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2017-06-19 16:00:42 +02:00
|
|
|
switch (encType) {
|
|
|
|
case constants.encType.Rsa2048_OaepSha256_B64:
|
|
|
|
case constants.encType.Rsa2048_OaepSha1_B64:
|
|
|
|
if (encPieces.length !== 1) {
|
|
|
|
return null;
|
|
|
|
}
|
|
|
|
break;
|
|
|
|
case constants.encType.Rsa2048_OaepSha256_HmacSha256_B64:
|
|
|
|
case constants.encType.Rsa2048_OaepSha1_HmacSha256_B64:
|
|
|
|
if (encPieces.length !== 2) {
|
|
|
|
return null;
|
|
|
|
}
|
|
|
|
break;
|
|
|
|
default:
|
|
|
|
return null;
|
|
|
|
}
|
|
|
|
|
|
|
|
var ctBytes = forge.util.decode64(encPieces[0]);
|
2017-04-21 19:46:07 +02:00
|
|
|
|
2017-06-19 16:00:42 +02:00
|
|
|
if (key && key.macKey && encPieces.length > 1) {
|
|
|
|
var macBytes = forge.util.decode64(encPieces[1]);
|
|
|
|
var computedMacBytes = computeMac(ctBytes, key.macKey, false);
|
|
|
|
if (!macsEqual(key.macKey, macBytes, computedMacBytes)) {
|
|
|
|
console.error('MAC failed.');
|
|
|
|
return null;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
var md;
|
|
|
|
if (encType === constants.encType.Rsa2048_OaepSha256_B64 ||
|
|
|
|
encType === constants.encType.Rsa2048_OaepSha256_HmacSha256_B64) {
|
2017-04-21 19:46:07 +02:00
|
|
|
md = forge.md.sha256.create();
|
|
|
|
}
|
2017-06-19 16:00:42 +02:00
|
|
|
else if (encType === constants.encType.Rsa2048_OaepSha1_B64 ||
|
|
|
|
encType === constants.encType.Rsa2048_OaepSha1_HmacSha256_B64) {
|
2017-04-21 19:46:07 +02:00
|
|
|
md = forge.md.sha1.create();
|
|
|
|
}
|
|
|
|
else {
|
|
|
|
throw 'encType unavailable.';
|
2017-04-07 05:00:33 +02:00
|
|
|
}
|
|
|
|
|
2017-02-28 06:18:11 +01:00
|
|
|
var decBytes = privateKey.decrypt(ctBytes, 'RSA-OAEP', {
|
2017-04-21 19:46:07 +02:00
|
|
|
md: md
|
2017-02-28 06:18:11 +01:00
|
|
|
});
|
|
|
|
|
|
|
|
return decBytes;
|
2017-03-01 04:53:19 +01:00
|
|
|
};
|
2017-02-28 06:18:11 +01:00
|
|
|
|
2017-06-19 16:00:42 +02:00
|
|
|
function computeMac(dataBytes, macKey, b64Output) {
|
2017-02-11 19:03:48 +01:00
|
|
|
var hmac = forge.hmac.create();
|
2017-04-19 04:28:49 +02:00
|
|
|
hmac.start('sha256', macKey);
|
2017-06-19 16:00:42 +02:00
|
|
|
hmac.update(dataBytes);
|
2017-02-11 19:03:48 +01:00
|
|
|
var mac = hmac.digest();
|
2017-04-27 17:35:30 +02:00
|
|
|
return b64Output ? forge.util.encode64(mac.getBytes()) : mac.getBytes();
|
|
|
|
}
|
|
|
|
|
2017-07-01 04:34:26 +02:00
|
|
|
function computeMacWC(dataBuf, macKeyBuf) {
|
2017-07-09 05:41:02 +02:00
|
|
|
return _subtle.importKey('raw', macKeyBuf, { name: 'HMAC', hash: { name: 'SHA-256' } }, false, ['sign'])
|
2017-06-30 22:22:39 +02:00
|
|
|
.then(function (key) {
|
2017-07-09 05:41:02 +02:00
|
|
|
return _subtle.sign({ name: 'HMAC', hash: { name: 'SHA-256' } }, key, dataBuf);
|
2017-06-30 22:22:39 +02:00
|
|
|
});
|
|
|
|
}
|
|
|
|
|
2017-04-27 18:14:11 +02:00
|
|
|
// Safely compare two MACs in a way that protects against timing attacks (Double HMAC Verification).
|
2017-04-27 18:00:32 +02:00
|
|
|
// ref: https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2011/february/double-hmac-verification/
|
|
|
|
function macsEqual(macKey, mac1, mac2) {
|
|
|
|
var hmac = forge.hmac.create();
|
2017-04-27 17:35:30 +02:00
|
|
|
|
2017-04-27 18:00:32 +02:00
|
|
|
hmac.start('sha256', macKey);
|
|
|
|
hmac.update(mac1);
|
|
|
|
mac1 = hmac.digest().getBytes();
|
|
|
|
|
|
|
|
hmac.start(null, null);
|
|
|
|
hmac.update(mac2);
|
|
|
|
mac2 = hmac.digest().getBytes();
|
2017-04-27 17:35:30 +02:00
|
|
|
|
2017-04-27 18:00:32 +02:00
|
|
|
return mac1 === mac2;
|
2016-12-09 04:21:46 +01:00
|
|
|
}
|
|
|
|
|
2017-07-01 04:34:26 +02:00
|
|
|
function macsEqualWC(macKeyBuf, mac1Buf, mac2Buf) {
|
|
|
|
var mac1,
|
|
|
|
macKey;
|
|
|
|
|
|
|
|
return window.crypto.subtle.importKey('raw', macKeyBuf, { name: 'HMAC', hash: { name: 'SHA-256' } }, false, ['sign'])
|
|
|
|
.then(function (key) {
|
|
|
|
macKey = key;
|
2017-07-08 06:12:57 +02:00
|
|
|
return window.crypto.subtle.sign({ name: 'HMAC', hash: { name: 'SHA-256' } }, macKey, mac1Buf);
|
2017-07-01 04:34:26 +02:00
|
|
|
}).then(function (mac) {
|
|
|
|
mac1 = mac;
|
2017-07-08 06:12:57 +02:00
|
|
|
return window.crypto.subtle.sign({ name: 'HMAC', hash: { name: 'SHA-256' } }, macKey, mac2Buf);
|
2017-07-01 04:34:26 +02:00
|
|
|
}).then(function (mac2) {
|
|
|
|
if (mac1.byteLength !== mac2.byteLength) {
|
|
|
|
return false;
|
|
|
|
}
|
|
|
|
|
|
|
|
var arr1 = new Uint8Array(mac1);
|
|
|
|
var arr2 = new Uint8Array(mac2);
|
|
|
|
|
|
|
|
for (var i = 0; i < arr2.length; i++) {
|
|
|
|
if (arr1[i] !== arr2[i]) {
|
|
|
|
return false;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
return true;
|
|
|
|
});
|
|
|
|
}
|
|
|
|
|
2017-04-22 20:39:40 +02:00
|
|
|
function SymmetricCryptoKey(keyBytes, b64KeyBytes, encType) {
|
2017-04-19 04:28:49 +02:00
|
|
|
if (b64KeyBytes) {
|
|
|
|
keyBytes = forge.util.decode64(keyBytes);
|
|
|
|
}
|
|
|
|
|
|
|
|
if (!keyBytes) {
|
|
|
|
throw 'Must provide keyBytes';
|
|
|
|
}
|
|
|
|
|
|
|
|
var buffer = forge.util.createBuffer(keyBytes);
|
|
|
|
if (!buffer || buffer.length() === 0) {
|
|
|
|
throw 'Couldn\'t make buffer';
|
|
|
|
}
|
2017-04-19 15:27:38 +02:00
|
|
|
var bufferLength = buffer.length();
|
2017-04-19 04:28:49 +02:00
|
|
|
|
|
|
|
if (encType === null || encType === undefined) {
|
2017-04-19 15:27:38 +02:00
|
|
|
if (bufferLength === 32) {
|
2017-04-19 04:28:49 +02:00
|
|
|
encType = constants.encType.AesCbc256_B64;
|
|
|
|
}
|
2017-04-19 15:27:38 +02:00
|
|
|
else if (bufferLength === 64) {
|
2017-04-19 04:28:49 +02:00
|
|
|
encType = constants.encType.AesCbc256_HmacSha256_B64;
|
|
|
|
}
|
|
|
|
else {
|
|
|
|
throw 'Unable to determine encType.';
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
this.key = keyBytes;
|
|
|
|
this.keyB64 = forge.util.encode64(keyBytes);
|
|
|
|
this.encType = encType;
|
|
|
|
|
2017-04-19 15:27:38 +02:00
|
|
|
if (encType === constants.encType.AesCbc256_B64 && bufferLength === 32) {
|
2017-04-19 04:28:49 +02:00
|
|
|
this.encKey = keyBytes;
|
|
|
|
this.macKey = null;
|
|
|
|
}
|
2017-04-19 15:27:38 +02:00
|
|
|
else if (encType === constants.encType.AesCbc128_HmacSha256_B64 && bufferLength === 32) {
|
2017-04-19 04:28:49 +02:00
|
|
|
this.encKey = buffer.getBytes(16); // first half
|
|
|
|
this.macKey = buffer.getBytes(16); // second half
|
|
|
|
}
|
2017-04-19 15:27:38 +02:00
|
|
|
else if (encType === constants.encType.AesCbc256_HmacSha256_B64 && bufferLength === 64) {
|
2017-04-19 04:28:49 +02:00
|
|
|
this.encKey = buffer.getBytes(32); // first half
|
|
|
|
this.macKey = buffer.getBytes(32); // second half
|
|
|
|
}
|
|
|
|
else {
|
2017-04-19 15:27:38 +02:00
|
|
|
throw 'Unsupported encType/key length.';
|
2017-04-19 04:28:49 +02:00
|
|
|
}
|
2017-04-19 15:03:47 +02:00
|
|
|
}
|
2017-04-19 04:28:49 +02:00
|
|
|
|
2017-06-30 22:22:39 +02:00
|
|
|
SymmetricCryptoKey.prototype.getBuffers = function () {
|
2017-07-01 04:34:26 +02:00
|
|
|
if (this.keyBuf) {
|
|
|
|
return this.keyBuf;
|
|
|
|
}
|
|
|
|
|
2017-06-30 22:22:39 +02:00
|
|
|
var key = b64ToArray(this.keyB64);
|
|
|
|
|
|
|
|
var keys = {
|
|
|
|
key: key.buffer
|
|
|
|
};
|
|
|
|
|
|
|
|
if (this.macKey) {
|
2017-07-08 06:12:57 +02:00
|
|
|
keys.encKey = slice(key, 0, key.length / 2).buffer;
|
|
|
|
keys.macKey = slice(key, key.length / 2).buffer;
|
2017-06-30 22:22:39 +02:00
|
|
|
}
|
|
|
|
else {
|
|
|
|
keys.encKey = key.buffer;
|
|
|
|
keys.macKey = null;
|
|
|
|
}
|
|
|
|
|
2017-07-01 04:34:26 +02:00
|
|
|
this.keyBuf = keys;
|
|
|
|
return this.keyBuf;
|
2017-06-30 22:22:39 +02:00
|
|
|
};
|
|
|
|
|
|
|
|
function b64ToArray(b64Str) {
|
2017-07-09 05:41:02 +02:00
|
|
|
var binaryString = $window.atob(b64Str);
|
2017-06-30 22:22:39 +02:00
|
|
|
var arr = new Uint8Array(binaryString.length);
|
|
|
|
for (var i = 0; i < binaryString.length; i++) {
|
|
|
|
arr[i] = binaryString.charCodeAt(i);
|
|
|
|
}
|
|
|
|
return arr;
|
|
|
|
}
|
|
|
|
|
2017-07-09 05:41:02 +02:00
|
|
|
function bufToB64(buf) {
|
|
|
|
var binary = '';
|
|
|
|
var bytes = new Uint8Array(buf);
|
|
|
|
for (var i = 0; i < bytes.byteLength; i++) {
|
|
|
|
binary += String.fromCharCode(bytes[i]);
|
|
|
|
}
|
|
|
|
return $window.btoa(binary);
|
|
|
|
}
|
|
|
|
|
|
|
|
function utf8ToArray(str) {
|
|
|
|
var utf8Str = unescape(encodeURIComponent(str));
|
|
|
|
var arr = new Uint8Array(utf8Str.length);
|
|
|
|
for (var i = 0; i < utf8Str.length; i++) {
|
|
|
|
arr[i] = utf8Str.charCodeAt(i);
|
|
|
|
}
|
|
|
|
return arr;
|
|
|
|
}
|
|
|
|
|
2017-07-08 06:12:57 +02:00
|
|
|
function slice(arr, begin, end) {
|
|
|
|
if (arr.slice) {
|
|
|
|
return arr.slice(begin, end);
|
|
|
|
}
|
|
|
|
|
|
|
|
// shim for IE
|
|
|
|
// ref: https://stackoverflow.com/a/21440217
|
|
|
|
|
|
|
|
arr = arr.buffer;
|
|
|
|
if (begin === void 0) {
|
|
|
|
begin = 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (end === void 0) {
|
|
|
|
end = arr.byteLength;
|
|
|
|
}
|
|
|
|
|
|
|
|
begin = Math.floor(begin);
|
|
|
|
end = Math.floor(end);
|
|
|
|
|
|
|
|
if (begin < 0) {
|
|
|
|
begin += arr.byteLength;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (end < 0) {
|
|
|
|
end += arr.byteLength;
|
|
|
|
}
|
|
|
|
|
|
|
|
begin = Math.min(Math.max(0, begin), arr.byteLength);
|
|
|
|
end = Math.min(Math.max(0, end), arr.byteLength);
|
|
|
|
|
|
|
|
if (end - begin <= 0) {
|
|
|
|
return new ArrayBuffer(0);
|
|
|
|
}
|
|
|
|
|
|
|
|
var result = new ArrayBuffer(end - begin);
|
|
|
|
var resultBytes = new Uint8Array(result);
|
|
|
|
var sourceBytes = new Uint8Array(arr, begin, end - begin);
|
|
|
|
|
|
|
|
resultBytes.set(sourceBytes);
|
|
|
|
return new Uint8Array(result);
|
|
|
|
}
|
|
|
|
|
2015-12-09 04:35:05 +01:00
|
|
|
return _service;
|
2017-04-19 04:28:49 +02:00
|
|
|
});
|