From 3fcc6c496b217e1e5c23b05188dcf68db8d7e0c8 Mon Sep 17 00:00:00 2001 From: Matthieu Gallien Date: Mon, 3 Feb 2025 15:08:38 +0100 Subject: [PATCH] partial fixes for sfoware end-to-end encryption issues currently being blocked by the padding leading to a decryption issue with some error messages Signed-off-by: Matthieu Gallien --- src/libsync/clientsideencryption.cpp | 12 ++++++++++-- src/libsync/foldermetadata.cpp | 13 ++++++++++++- 2 files changed, 22 insertions(+), 3 deletions(-) diff --git a/src/libsync/clientsideencryption.cpp b/src/libsync/clientsideencryption.cpp index 5392370c22d3e..ba7ed3e1fe47b 100644 --- a/src/libsync/clientsideencryption.cpp +++ b/src/libsync/clientsideencryption.cpp @@ -902,7 +902,11 @@ CertificateInformation ClientSideEncryption::getCertificateInformationByFingerpr int ClientSideEncryption::paddingMode() const { - return RSA_PKCS1_PADDING; + if (useTokenBasedEncryption()) { + return RSA_PKCS1_PADDING; + } else { + return RSA_PKCS1_OAEP_PADDING; + } } CertificateInformation ClientSideEncryption::getTokenCertificateByFingerprint(const QByteArray &expectedFingerprint) const @@ -2638,6 +2642,10 @@ bool EncryptionHelper::dataDecryption(const QByteArray &key, const QByteArray &i qCDebug(lcCse) << "Could not use empty input data"; } + qCInfo(lcCse()) << "key" << key.toBase64(); + qCInfo(lcCse()) << "iv" << iv.toBase64(); + qCInfo(lcCse()) << "input" << input.toBase64(); + QByteArray inputCopy = input; QBuffer inputBuffer(&inputCopy); @@ -2714,7 +2722,7 @@ bool EncryptionHelper::dataDecryption(const QByteArray &key, const QByteArray &i } if (1 != EVP_DecryptFinal_ex(ctx, unsignedData(out), &len)) { - qCInfo(lcCse()) << "Could finalize decryption"; + qCInfo(lcCse()) << "Could not finalize decryption"; return false; } outputBuffer.write(out, len); diff --git a/src/libsync/foldermetadata.cpp b/src/libsync/foldermetadata.cpp index 8ceb22dd1ea80..a0c1db6f6625c 100644 --- a/src/libsync/foldermetadata.cpp +++ b/src/libsync/foldermetadata.cpp @@ -162,6 +162,7 @@ void FolderMetadata::setupExistingMetadata(const QByteArray &metadata) / Can the attacker use outdated certificate as an attack vector?*/ folderUser.certificatePem = folderUserObject.value(usersCertificateKey).toString().toUtf8(); folderUser.encryptedMetadataKey = QByteArray::fromBase64(folderUserObject.value(usersEncryptedMetadataKey).toString().toUtf8()); + qCInfo(lcCseMetadata()) << "folderUser.encryptedMetadataKey" << folderUser.encryptedMetadataKey.toBase64(); _folderUsers[userId] = folderUser; } @@ -190,8 +191,11 @@ void FolderMetadata::setupExistingMetadata(const QByteArray &metadata) if (_folderUsers.contains(_account->davUser())) { const auto currentFolderUser = _folderUsers.value(_account->davUser()); _e2eCertificateFingerprint = QSslCertificate{currentFolderUser.certificatePem}.digest(QCryptographicHash::Sha256).toBase64(); - _metadataKeyForEncryption = QByteArray::fromBase64(decryptDataWithPrivateKey(currentFolderUser.encryptedMetadataKey, _e2eCertificateFingerprint)); + _metadataKeyForEncryption = QByteArray::fromBase64(decryptDataWithPrivateKey(currentFolderUser.encryptedMetadataKey.toBase64(), _e2eCertificateFingerprint)); + qCInfo(lcCseMetadata()) << "_metadataKeyForEncryption" << _metadataKeyForEncryption.toBase64(); + qCInfo(lcCseMetadata()) << "_metadataKeyForEncryption" << _metadataKeyForEncryption; _metadataKeyForDecryption = _metadataKeyForEncryption; + qCInfo(lcCseMetadata()) << "_metadataKeyForDecryption" << _metadataKeyForDecryption.toBase64(); } if (!parseFileDropPart(metaDataDoc)) { @@ -448,12 +452,19 @@ QByteArray FolderMetadata::encryptDataWithPublicKey(const QByteArray &binaryData QByteArray FolderMetadata::decryptDataWithPrivateKey(const QByteArray &base64Data, const QByteArray &certificateFingerprint) const { + qCInfo(lcCseMetadata()) << "base64Data" << base64Data; + const auto certificateInfo = _account->e2e()->getCertificateInformationByFingerprint(certificateFingerprint); + qCInfo(lcCseMetadata()) << "_account->e2e()->_privateKey" << certificateInfo.getPrivateKeyData().toBase64(); + const auto decryptBase64Result = EncryptionHelper::decryptStringAsymmetric(_account->e2e()->getCertificateInformationByFingerprint(certificateFingerprint), _account->e2e()->paddingMode(), *_account->e2e(), base64Data); if (!decryptBase64Result) { qCDebug(lcCseMetadata()) << "ERROR. Could not decrypt the metadata key"; _account->reportClientStatus(OCC::ClientStatusReportingStatus::E2EeError_GeneralError); return {}; } + + qCInfo(lcCseMetadata()) << "decryptBase64Result" << (*decryptBase64Result); + return *decryptBase64Result; }