brix / crypto-js

JavaScript library of crypto standards.
Other
15.87k stars 2.39k forks source link

Base64 ecryption-decryption is broken in v4.1.1 #447

Open Aivean opened 1 year ago

Aivean commented 1 year ago

JSFiddle: http://jsfiddle.net/c5xf6hbd/

Repro:

const iv = CryptoJS.lib.WordArray.random(32);
console.log(iv.words);
const enc =  CryptoJS.enc.Base64.stringify(iv)
console.log(enc);
const dec = CryptoJS.enc.Base64.parse(enc);
console.log(dec.words);

Produces:

[3175402278, 622507755, 4053109661, 3043648788, 1721660984, 3272352803, 1267570097, 1427537722]
"vUTLJiUatuvxlYudtWplFGaedjjDDCQjS42VsVUWfzo="
[-1119565018, 622507755, -241857635, -1251318508, 1721660984, -1022614493, 1267570097, 1427537722]

Works in v3.x.x

mahnunchik commented 1 year ago

Still broken

windsurfer1122 commented 1 year ago

3175402278 = BD44CB26 -1119565018 = BD44CB26

Not "broken", but "broken". random() creates unsigned integers, while parse() creates signed integers. Convert negative integer to its two's complement via unsigned right shift: integer >>>= 0