AKushWarrior / steel_crypt

A collection of high-level API's exposing PointyCastle to perform hashing and encrypting in popular/secure algorithms.
https://pub.dev/packages/steel_crypt
Mozilla Public License 2.0
40 stars 10 forks source link

Questions about ebc #5

Closed chuzhaoqian closed 4 years ago

chuzhaoqian commented 4 years ago

`dart var FortunaKey = 'qHjzUlcH02Q0zupxOSPPVQoY-LBI8Cmf4WoUNhw90B4==';

var aesEncrypter = AesCrypt(FortunaKey, 'ecb');

String encrypted = aesEncrypter.encrypt('1234567890', 'YueITUmQ0JBjH8==');

print(encrypted); `

`log Unhandled exception: type 'ParametersWithIV' is not a subtype of type 'KeyParameter' of 'params'

0 AESFastEngine.init (package:steel_crypt/PointyCastleN/block/aes_fast.dart)

1 ECBBlockCipher.init (package:steel_crypt/PointyCastleN/block/modes/ecb.dart:37:23)

2 PaddedBlockCipherImpl.init (package:steel_crypt/PointyCastleN/padded_block_cipher/padded_block_cipher_impl.dart:43:12)

3 AesCrypt.encrypt (package:steel_crypt/src/aes.dart:67:15)

4 main (test.dart:22:34)

5 _startIsolate. (dart:isolate-patch/isolate_patch.dart:303:32)

6 _RawReceivePortImpl._handleMessage (dart:isolate-patch/isolate_patch.dart:172:12)

`

AKushWarrior commented 4 years ago

This actually looks like good code on your part, so I'll spend some time figuring out what's wrong here. Thanks for the heads up, and I'll comment back when I publish a hotfix.

AKushWarrior commented 4 years ago

Okay, the issue is fixed. The problem is that ECB, as a mode, is incompatible with an IV. Thus, there was an internal error with passing an IV, since I abstract AES modes together. Regardless, it's been fixed. If you update to the latest version of steel_crypt (1.3.2+1), you will be able to run the code below:

var FortunaKey = 'qHjzUlcH02Q0zupxOSPPVQoY-LBI8Cmf4WoUNhw90B4==';

var aesEncrypter = AesCrypt(FortunaKey, 'ecb');

String encrypted = aesEncrypter.encrypt('1234567890');

print(encrypted);

However, I would be remiss if I didn't note that ECB is dangerously insecure. Because it's the only mode which doesn't take an IV, it's susceptible to key-parsing attacks, and should only ever be used with small (length < 16) blocks of data. Because of this, I'd recommend you use another mode; my personal recommendation is CFB-64.