search

firstfloorsoftware / flutter_sodium

Flutter bindings for libsodium
BSD 3-Clause "New" or "Revised" License
102 stars 47 forks source link

Key derivation using XOR (^) instead of power function #69

Open guilhermeavanci opened 2 years ago

guilhermeavanci commented 2 years ago

Hi guys!

I recently moved an app to Flutter 2.x, and with that updated the flutter_sodium to the most up-to-date version.

After the update I started getting an RangeError coming from the library. Following the functions' calls I faced what I believe to be the issue. Just to clarify, here is the step-by-step:

KeyDerivation.derive (src/key_derivation.dart) -> cryptoKdfDeriveFromKey (src/sodium.dart) -> RangeError.checkValueInInterval(subkeyId, 0, (2 ^ 64) - 1, 'subkeyId')

The code checks here if subkeyId fit in the interval between 0 and (2 ^ 64) - 1.

Something was off about this error, so I made some research and concluded it's a typo in the max value of the range, probably came from the official sodium key derivation docs or something like that. In this page we have the identical math operation: subkey_id can be any value up to (2^64)-1.

Apparently the end of the interval is erroneous represented here using the math notation instead of dart language notation, which means the ^ character is a bitwise XOR instead of the math operation power, which I suppose should be the correct thing to do here. Btw, the result of (2 ^ 64) - 1 is always 65.

Anyway, here is the issue. Can you guys confirm? I hope I'm not being blind about something and opening an issue with no need.

guilhermeavanci commented 2 years ago

Maybe we can't just use a power function to solve that, but to get the biggest number we can use ~(1 << 63). Sadly it won't work in 32 bits systems, like Javascript probably.

guilhermeavanci commented 2 years ago

We can also use -1 >>> 1 to get the max int value for the current system, but I don't believe that's what you guys want, right?