0

I'm using node forge to encrypt a form before sending it to the server using AES.

The code for the crypto part for now is

const bigInt = require("big-integer");
const forge = require('node-forge');

function generateParams() {
    // Cryptographic random number generator
    var array = new Uint32Array(2);
    var _key = bigInt(window.crypto.getRandomValues(array)[0]).toString();
    var _iv = bigInt(window.crypto.getRandomValues(array)[1]).toString();
    // generate random key and IV 
    var key = forge.util.encode64(_key);
    var iv = forge.util.encode64(_iv);
    const params = {
        key: key,
        iv: iv
    }
    return params;
}

function encrypt(params) {
    var cipher = forge.rc2.createEncryptionCipher(params.key);
    cipher.start(params.iv);
    // Encrypting "testing"
    cipher.update(forge.util.createBuffer("testing"));
    cipher.finish();
    return cipher.output;
}

function decrypt(params, encrypted) {
    var cipher = forge.rc2.createDecryptionCipher(params.key);
    cipher.start(params.iv);
    cipher.update(encrypted);
    cipher.finish();
    return cipher.output;
}

and the jQuery function is (not posting yet)

$('#recordForm').submit(function(event) {
    // Stop form from submitting normally
    event.preventDefault();
    // Grab form data
    // Crypto
    const params = generateParams();
    const encryptedForm = {
        test: encrypt(params),
    }
    console.log("Encrypted: " + encryptedForm.test);
    const decryptedForm = {
        test: decrypt(params, encryptedForm.id).data,
    }
    console.log("Decrypted: " + decryptedForm.test);
});

My problem is that I keep getting back (cryptob.js is the name of my file, generated with browserify)

Uncaught URIError: URI malformed
    at decodeURIComponent (<anonymous>)
    at Object.util.decodeUtf8 (cryptob.js:24437)
    at ByteStringBuffer.util.ByteStringBuffer.toString (cryptob.js:23490)
    at HTMLFormElement.<anonymous> (cryptob.js:1282)
    at HTMLFormElement.dispatch (jquery-3.1.1.slim.min.js:3)
    at HTMLFormElement.q.handle (jquery-3.1.1.slim.min.js:3)

when calling encrypt().

There is this answer here which recommends including a special meta tag. I have done that but it still doesn't work. Since some resources online say it is related to UTF-8 encoding, I tried replacing

cipher.update(forge.util.createBuffer("testing"));

with

cipher.update(forge.util.createBuffer(encodeURIComponent("testing")));

or

cipher.update(forge.util.createBuffer("testing", 'utf8'));

but it didn't work either (based on encodeURIComponent(str)).

You can test forge here, and if you run this code (which is essentially what I'm doing)

var forge = require("node-forge")

// generate a random key and IV 
var key = forge.util.encode64("12354523465");
var iv = forge.util.encode64("2315");

// encrypt some bytes 
var cipher = forge.rc2.createEncryptionCipher(key);
cipher.start(iv);
cipher.update(forge.util.createBuffer("testing"));
cipher.finish();
var encrypted = cipher.output; 
console.log(encrypted);

// decrypt some bytes 
var cipher = forge.rc2.createDecryptionCipher(key);
cipher.start(iv);
cipher.update(encrypted);
cipher.finish();
console.log(cipher.output.data)

it works fine.

How can I solve this?

1
  • RC2 is a different cipher than AES. Accoding to the documentation, either use var cipher = forge.cipher.createCipher('AES-CBC', key); or forge.aes.createEncryptionCipher(key);. Also, you shouldn't use CBC mode. It is better to use GCM mode.
    – Artjom B.
    Aug 21, 2017 at 13:29

1 Answer 1

0

It looks like this error is actually happening in the toString, where you generate your _key and _iv.

Try testing with some hard-coded strings, as used in the example code you posted. Then, use a method to generate random byte strings for the key and IV.

Also, for AES-256, the key should have 32 bytes (not bits) of entropy. The IV should have 16 bytes of entropy.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.