support AES-256-CBC for decryption

[alexandre-abrioux]

First of all, thank you for maintaining this excellent library 🙂

I'm currently trying to migrate from eccrypto, and it looks like I'm not able to decrypt previously encrypted messages, possibly because eccrypto uses AES-256-CBC for ECIES instead of AES-256-GCM.

Would you consider adding support for AES-256-CBC, at least for decryption?

Test case

With the following test case:

it("test", () => {
  const privateKey = '0x4025da5692759add08f98f4b056c41c71916a671cedc7584a80d73adc7fb43c0';
  const encryptedData = '307bac038efaa5bf8a0ac8db53fd4de8024a0c0baf37283a9e6671589eba18edc12b3915ff0df66e6ffad862440228a65ead99e3320e50aa90008961e3d68acc35b314e98020e3280bf4ce4258419dbb775185e60b43e7b88038a776a9322ff7cb3e886b2d92060cff2951ef3beedcc70a';
  const data = decrypt(privateKey, Buffer.from(encryptedData, 'hex')).toString();
  expect(data).toBe('this is any data!');
})

I'm getting this error:

Error: bad point: equation left != right

[kigawas]

Thanks for your advice. I'll try to make it compatible with aes-256-cbc.

It seems the public key in your encrypted data (04307bac038efaa5bf8a0ac8db53fd4de8024a0c0baf37283a9e6671589eba18edc12b3915ff0df66e6ffad862440228a65ead99e3320e50aa90008961e3d68acc) is not a valid secp256k1 public key, can you double-check or provide another test vector?

[kigawas]

By the way, aes cbc mode is not recommended because it has no aead tag. You should use aes gcm or xchacha20 instead

[kigawas]

Another point is that eccrypto is using sha512 (specifically the first 32 bytes of SHA512(ECDH(ephermeralPublicKey, publicKey)) to derive the shared key (https://github.com/bitchan/eccrypto/blob/master/index.js#L219 or https://github.com/torusresearch/eccrypto/blob/master/src/index.ts#L248) but we are using HDKF-SHA256, this also makes it incompatible.

[alexandre-abrioux]

Thank you so much for your answers @kigawas!

It seems the public key in your encrypted data is not a valid secp256k1 public key

Indeed, the first two characters 04 were manually added by myself; it's a mistake. I've edited my original message.
You can see the original test in its public repository.

aes cbc mode is not recommended

Yes, we would love to have the option to migrate while still being able to decrypt old data 🙏

[kigawas]

No, there's another mistake. A valid public key can only start with 04/02/03:

Can you directly show me the exact ephemeral public key, the derived aes-256-cbc key, iv, and the encrypted data?

You can find the implementation here.

Since we don't have a plan to support SHA512 as a key derivation function, you may need to think about a migration strategy.

[kigawas]

It should be easy to use this library to build your own ecies logic with PrivateKey, PublicKey, aesEncrypt, aesDecrypt

[alexandre-abrioux]

Thanks for clarifying! Those are the corresponding ECIES parameters for the test:

• iv: 307bac038efaa5bf8a0ac8db53fd4de8
• mac: ad99e3320e50aa90008961e3d68acc35b314e98020e3280bf4ce4258419dbb77
• cipher: 5185e60b43e7b88038a776a9322ff7cb3e886b2d92060cff2951ef3beedcc70a
• public key (compressed): 024a0c0baf37283a9e6671589eba18edc12b3915ff0df66e6ffad862440228a65e
• public key (uncompressed): 044a0c0baf37283a9e6671589eba18edc12b3915ff0df66e6ffad862440228a65e78c0a389d0a6da364ed32ee715814dafb6256471a38c6b71ecc15eff5c561942

[kigawas]

You can inherit the PrivateKey to override:

  public encapsulate(pk: PublicKey): Uint8Array {
    // sha512 version
    let senderPoint: Uint8Array;
    let sharedPoint: Uint8Array;
    if (isHkdfKeyCompressed()) {
      senderPoint = this.publicKey.compressed;
      sharedPoint = this.multiply(pk, true);
    } else {
      senderPoint = this.publicKey.uncompressed;
      sharedPoint = this.multiply(pk, false);
    }
    return sha512(concatBytes(senderPoint, sharedPoint)).subarray(0, 32);
  }

Then

export function encrypt(receiverRawPK: string | Uint8Array, msg: Uint8Array): Buffer {
  ECIES_CONFIG.symmetricAlgorithm = 'aes-256-cbc'; // TODO: implement

  const ephemeralKey = new PrivateKey();

  const receiverPK =
    receiverRawPK instanceof Uint8Array
      ? new PublicKey(receiverRawPK)
      : PublicKey.fromHex(receiverRawPK);

  const symKey = ephemeralKey.encapsulate(receiverPK);
  const encrypted = aesEncrypt(symKey, msg);

  let pk: Uint8Array;
  if (isEphemeralKeyCompressed()) {
    pk = ephemeralKey.publicKey.compressed;
  } else {
    pk = ephemeralKey.publicKey.uncompressed;
  }
  return Buffer.from(concatBytes(pk, encrypted));
}

If you only need to decrypt, you can just inherit corresponding PublicKey and modify decrypt

[alexandre-abrioux]

Thanks a lot! I will explore this a bit more in my free time. If I can make it work, I'll post the implementation here, it might help someone else 👍

[kigawas]

CBC is added to this branch

https://github.com/ecies/js/tree/add-cbc

[kigawas]

It's now included in version 0.4.6, if you have any problem feel free to comment