anusii / rdflib

A pure Dart package for working with RDF (resource description framework).
https://pub.dev/packages/rdflib
GNU General Public License v3.0
13 stars 3 forks source link

RDF: fix the issue of using encryption/decryption hashed key as the real key for `AES` #5

Closed tian3rd closed 1 year ago

tian3rd commented 1 year ago

Just found out that in the encryption/decryption process, the methods use the hashed key as the real key, and this key is actually stored in the encrypted .enc.ttl file in plaintext. This is not right. The right way to do it is to use the original key, but needs to find a way to convert different length to a fixed 32-long in order to use AES.

tian3rd commented 1 year ago

Hashed key is generated with sha256 for quick verification and is stored in the encrypted file, but the real key is hidden and not stored anywhere, so only when the user's passphrase matches the sh256 key in the encrypted file, then we proceed to decrypt the file:

  1. first generate the real key for AES (256 bits / 32 bytes) with the first 32 chars of sha512
  2. then use this real key to decrypt the content