partial fixes for sfoware end-to-end encryption issues

currently being blocked by the padding leading to a decryption issue with some error messages Signed-off-by: Matthieu Gallien <[email protected]>
nextcloud · Feb 3, 2025 · 3fcc6c4 · 3fcc6c4
1 parent 943054f
commit 3fcc6c4
Show file tree

Hide file tree

Showing 2 changed files with 22 additions and 3 deletions.
diff --git a/src/libsync/clientsideencryption.cpp b/src/libsync/clientsideencryption.cpp
@@ -902,7 +902,11 @@ CertificateInformation ClientSideEncryption::getCertificateInformationByFingerpr
 
 int ClientSideEncryption::paddingMode() const
 {
-    return RSA_PKCS1_PADDING;
+    if (useTokenBasedEncryption()) {
+        return RSA_PKCS1_PADDING;
+    } else {
+        return RSA_PKCS1_OAEP_PADDING;
+    }
 }
 
 CertificateInformation ClientSideEncryption::getTokenCertificateByFingerprint(const QByteArray &expectedFingerprint) const
@@ -2638,6 +2642,10 @@ bool EncryptionHelper::dataDecryption(const QByteArray &key, const QByteArray &i
         qCDebug(lcCse) << "Could not use empty input data";
     }
 
+    qCInfo(lcCse()) << "key" << key.toBase64();
+    qCInfo(lcCse()) << "iv" << iv.toBase64();
+    qCInfo(lcCse()) << "input" << input.toBase64();
+
     QByteArray inputCopy = input;
 
     QBuffer inputBuffer(&inputCopy);
@@ -2714,7 +2722,7 @@ bool EncryptionHelper::dataDecryption(const QByteArray &key, const QByteArray &i
     }
 
     if (1 != EVP_DecryptFinal_ex(ctx, unsignedData(out), &len)) {
-        qCInfo(lcCse()) << "Could finalize decryption";
+        qCInfo(lcCse()) << "Could not finalize decryption";
         return false;
     }
     outputBuffer.write(out, len);

diff --git a/src/libsync/foldermetadata.cpp b/src/libsync/foldermetadata.cpp
@@ -162,6 +162,7 @@ void FolderMetadata::setupExistingMetadata(const QByteArray &metadata)
         /  Can the attacker use outdated certificate as an attack vector?*/
         folderUser.certificatePem = folderUserObject.value(usersCertificateKey).toString().toUtf8();
         folderUser.encryptedMetadataKey = QByteArray::fromBase64(folderUserObject.value(usersEncryptedMetadataKey).toString().toUtf8());
+        qCInfo(lcCseMetadata()) << "folderUser.encryptedMetadataKey" << folderUser.encryptedMetadataKey.toBase64();
         _folderUsers[userId] = folderUser;
     }
 
@@ -190,8 +191,11 @@ void FolderMetadata::setupExistingMetadata(const QByteArray &metadata)
     if (_folderUsers.contains(_account->davUser())) {
         const auto currentFolderUser = _folderUsers.value(_account->davUser());
         _e2eCertificateFingerprint = QSslCertificate{currentFolderUser.certificatePem}.digest(QCryptographicHash::Sha256).toBase64();
-        _metadataKeyForEncryption = QByteArray::fromBase64(decryptDataWithPrivateKey(currentFolderUser.encryptedMetadataKey, _e2eCertificateFingerprint));
+        _metadataKeyForEncryption = QByteArray::fromBase64(decryptDataWithPrivateKey(currentFolderUser.encryptedMetadataKey.toBase64(), _e2eCertificateFingerprint));
+        qCInfo(lcCseMetadata()) << "_metadataKeyForEncryption" << _metadataKeyForEncryption.toBase64();
+        qCInfo(lcCseMetadata()) << "_metadataKeyForEncryption" << _metadataKeyForEncryption;
         _metadataKeyForDecryption = _metadataKeyForEncryption;
+        qCInfo(lcCseMetadata()) << "_metadataKeyForDecryption" << _metadataKeyForDecryption.toBase64();
     }
 
     if (!parseFileDropPart(metaDataDoc)) {
@@ -448,12 +452,19 @@ QByteArray FolderMetadata::encryptDataWithPublicKey(const QByteArray &binaryData
 QByteArray FolderMetadata::decryptDataWithPrivateKey(const QByteArray &base64Data,
                                                      const QByteArray &certificateFingerprint) const
 {
+    qCInfo(lcCseMetadata()) << "base64Data" << base64Data;
+    const auto certificateInfo = _account->e2e()->getCertificateInformationByFingerprint(certificateFingerprint);
+    qCInfo(lcCseMetadata()) << "_account->e2e()->_privateKey" << certificateInfo.getPrivateKeyData().toBase64();
+
     const auto decryptBase64Result = EncryptionHelper::decryptStringAsymmetric(_account->e2e()->getCertificateInformationByFingerprint(certificateFingerprint), _account->e2e()->paddingMode(), *_account->e2e(), base64Data);
     if (!decryptBase64Result) {
         qCDebug(lcCseMetadata()) << "ERROR. Could not decrypt the metadata key";
         _account->reportClientStatus(OCC::ClientStatusReportingStatus::E2EeError_GeneralError);
         return {};
     }
+
+    qCInfo(lcCseMetadata()) << "decryptBase64Result" << (*decryptBase64Result);
+
     return *decryptBase64Result;
 }