@secrecy/lib 1.86.4-fix-md5.1 → 1.86.4-fix-crypto.1

package/dist/lib/client/SecrecyCloudClient.js

@@ -700,12 +700,13 @@ export class SecrecyCloudClient {
                     : this.#client.currentIdentity.identityPubKey, this.#client.currentIdentityPrivateKey)
             : null;
         const src = key
-            ? await decrypt(key, encryptedContent, progressDecrypt, signal)
+            ? // Legacy streams may lack the final tag: the md5 check below covers them.
+                await decrypt(key, encryptedContent, progressDecrypt, signal, {
+                    allowMissingFinalTag: true,
+                })
             : encryptedContent;
-        // Encrypted data is authenticated by the stream: only public data has an md5.
-        if (!key &&
-            dataContent.md5 !== null &&
-            (await md5(src)) !== dataContent.md5) {
+        const md5Content = await md5(src);
+        if (md5Content !== dataContent.md5) {
             throw new Error(`Content does not match`);
         }
         const decompressed = decompress(src);

package/dist/lib/client/data-link.js

@@ -3,11 +3,11 @@ import { buildBytesFromDataLink } from '../crypto/domain';
 import { sodium } from '../sodium';
 import { decryptKeyWithPassword } from '../crypto/helpers';
 import { decrypt } from '../worker/sodium';
+import { md5 } from '../worker/md5';
 import { decompress } from '../minify';
 const downloadDataLinkS3Schema = z.object({
     name: z.string(),
-    // Only for unencrypted and legacy encrypted data.
-    md5: z.string().nullable(),
+    md5: z.string(),
     md5Encrypted: z.string().nullable(),
     size: z.coerce.bigint().gte(0n),
     parts: z.array(z.object({ order: z.number(), md5: z.string(), contentUrl: z.string() })),
@@ -16,8 +16,7 @@ const downloadDataLinkS3Schema = z.object({
 });
 const downloadDataLinkLiteSchema = z.object({
     name: z.string(),
-    // Only for unencrypted and legacy encrypted data.
-    md5: z.string().nullable(),
+    md5: z.string(),
     md5Encrypted: z.string().nullable(),
     size: z.coerce.bigint().gte(0n),
     bytes: z.string(),
@@ -69,8 +68,14 @@ export async function downloadDataFromLink(opts) {
         throw new Error('Unable to read encrypted data without password!');
     }
     try {
-        const decryptedSharingDataKey = decryptKeyWithPassword(sodium.from_hex(opts.crypto.key), opts.crypto.password);
-        const decryptedBytes = await decrypt(decryptedSharingDataKey, bytes, opts.decryptProgress, opts.signal);
+        const decryptedSharingDataKey = decryptKeyWithPassword(sodium.from_hex(opts.crypto.key), opts.crypto.password, dataLink.md5);
+        const decryptedBytes = await decrypt(decryptedSharingDataKey, bytes, opts.decryptProgress, opts.signal, 
+        // Legacy streams may lack the final tag: the md5 check below covers them.
+        { allowMissingFinalTag: true });
+        const md5Content = await md5(decryptedBytes);
+        if (md5Content !== dataLink.md5) {
+            throw new Error(`Content does not match`);
+        }
         return decompress(decryptedBytes);
     }
     catch (err) {

package/dist/lib/client/helpers.js

@@ -3,11 +3,22 @@ import { popup } from '../utils/popup-tools.js';
 import { secrecyUserApp } from './types/index.js';
 import { getStorage } from './storage.js';
 import { setup } from '../sodium.js';
+export function assertBrowser(fn) {
+    if (typeof window === 'undefined') {
+        const err = {
+            name: 'ClientError',
+            code: 'SERVER_ENVIRONMENT',
+            message: `${fn}() can only run in a browser. On Next.js, call it from a "use client" component, or via dynamic(..., { ssr: false }).`,
+        };
+        throw err;
+    }
+}
 export function parseInfos() {
+    assertBrowser('parseInfos');
     if (window.location.hash === '') {
         return null;
     }
-    const hash = window.location.hash.substr(1);
+    const hash = window.location.hash.slice(1);
     try {
         const res = JSON.parse(atob(hash));
         // Replace (not push) the entry: the fragment holds the private keys and
@@ -21,6 +32,7 @@ export function parseInfos() {
     }
 }
 export function getSecrecyClient(opts = {}) {
+    assertBrowser('getSecrecyClient');
     const storage = getStorage(opts.session);
     const infos = parseInfos();
     if (infos !== null) {
@@ -52,6 +64,7 @@ export function getSecrecyClient(opts = {}) {
     return null;
 }
 export async function login({ appId, context, path, redirect, scopes, backPath, session, secrecyUrls, forceLogin, }) {
+    assertBrowser('login');
     return await new Promise(async (resolve, reject) => {
         const appUrl = window.location.origin;
         const client = getSecrecyClient({ session, secrecyUrls });
@@ -139,6 +152,7 @@ export async function login({ appId, context, path, redirect, scopes, backPath,
  * juggle the sync/async mismatch between them.
  */
 export async function initSecrecy(opts) {
+    assertBrowser('initSecrecy');
     await setup();
     const existing = getSecrecyClient({
         session: opts.session,

package/dist/lib/client/upload.js

@@ -40,10 +40,7 @@ export async function uploadData({ storageType, data, password, forcePassword =
         throw new Error('Cold storage is only for logged users!');
     }
     const compressed = encrypted ? compress(dataBuffer) : dataBuffer;
-    // Only unencrypted (public) data sends the md5 of its content, computed in
-    // the requests below: for encrypted data it would let the server
-    // fingerprint the plaintext.
-    let { encryptedData, encryptedDataKey, dataKey, md5Encrypted } = encrypted
+    let { encryptedData, encryptedDataKey, dataKey, md5Data, md5Encrypted } = encrypted
         ? await encryptDataAndKey({
             data: compressed,
             progress: encryptProgress,
@@ -55,6 +52,7 @@ export async function uploadData({ storageType, data, password, forcePassword =
             encryptedData: compressed,
             encryptedDataKey: null,
             dataKey: null,
+            md5Data: await md5(compressed),
             md5Encrypted: null,
         };
     await uploadProgress?.({
@@ -102,13 +100,14 @@ export async function uploadData({ storageType, data, password, forcePassword =
                 size: BigInt(dataBuffer.byteLength),
                 key: encryptedDataKey ? sodium.to_hex(encryptedDataKey) : undefined,
                 md5Encrypted,
+                md5: md5Data,
                 fromIdentityPubKey: currentIdentity?.identityPubKey,
                 ...filetype,
             }
             : {
                 type: 'unencrypted',
                 content: Buffer.from(encryptedData),
-                md5: await md5(compressed),
+                md5: md5Data,
                 size: BigInt(dataBuffer.byteLength),
                 fromIdentityPubKey: currentIdentity?.identityPubKey,
                 ...filetype,
@@ -123,7 +122,7 @@ export async function uploadData({ storageType, data, password, forcePassword =
         const localData = {
             id: uploadData.id,
             storageType: 'lite',
-            md5: uploadDataArgs.type === 'unencrypted' ? uploadDataArgs.md5 : null,
+            md5: uploadDataArgs.md5,
             size: uploadDataArgs.size,
             sizeEncrypted: uploadDataArgs.type === 'encrypted'
                 ? uploadDataArgs.sizeEncrypted
@@ -145,12 +144,13 @@ export async function uploadData({ storageType, data, password, forcePassword =
                 size: BigInt(dataBuffer.byteLength),
                 key: encryptedDataKey ? sodium.to_hex(encryptedDataKey) : undefined,
                 md5Encrypted,
+                md5: md5Data,
                 fromIdentityPubKey: currentIdentity?.identityPubKey,
                 ...filetype,
             }
             : {
                 type: 'unencrypted',
-                md5: await md5(compressed),
+                md5: md5Data,
                 size: BigInt(dataBuffer.byteLength),
                 fromIdentityPubKey: currentIdentity?.identityPubKey,
                 ...filetype,
@@ -171,7 +171,7 @@ export async function uploadData({ storageType, data, password, forcePassword =
             const localData = {
                 id: uploadData.id,
                 storageType: storageType,
-                md5: uploadDataArgs.type === 'unencrypted' ? uploadDataArgs.md5 : null,
+                md5: uploadDataArgs.md5,
                 size: uploadDataArgs.size,
                 sizeEncrypted: uploadDataArgs.type === 'encrypted'
                     ? uploadDataArgs.sizeEncrypted
@@ -255,7 +255,7 @@ export async function uploadData({ storageType, data, password, forcePassword =
         const localData = {
             id: uploadData.id,
             storageType: storageType,
-            md5: uploadDataArgs.type === 'unencrypted' ? uploadDataArgs.md5 : null,
+            md5: uploadDataArgs.md5,
             size: uploadDataArgs.size,
             sizeEncrypted: uploadDataArgs.type === 'encrypted'
                 ? uploadDataArgs.sizeEncrypted

package/dist/lib/crypto/data.js

@@ -79,6 +79,7 @@ export async function encryptSecretStream(key, data, progress, signal) {
         });
         const final = new Uint8Array(max);
         const sparkEncrypted = new SparkMD5.ArrayBuffer();
+        const spark = new SparkMD5.ArrayBuffer();
         final.set(header);
         sparkEncrypted.append(header.buffer);
         let total = header.byteLength;
@@ -92,7 +93,8 @@ export async function encryptSecretStream(key, data, progress, signal) {
             if (signal?.aborted === true) {
                 throw new Error(`Encrypt aborted`);
             }
-            const chunk = data.subarray(i * CHUNK_SIZE, (i + 1) * CHUNK_SIZE);
+            const chunk = data.slice(i * CHUNK_SIZE, (i + 1) * CHUNK_SIZE);
+            spark.append(chunk.buffer);
             const tag = i === chunkCount - 1
                 ? sodium.crypto_secretstream_xchacha20poly1305_TAG_FINAL
                 : sodium.crypto_secretstream_xchacha20poly1305_TAG_MESSAGE;
@@ -118,6 +120,7 @@ export async function encryptSecretStream(key, data, progress, signal) {
         return {
             data: final,
             md5Encrypted: sparkEncrypted.end(),
+            md5: spark.end(),
         };
     }
     finally {
@@ -127,9 +130,9 @@ export async function encryptSecretStream(key, data, progress, signal) {
 /**
  * Decrypt a secretstream produced by `encryptSecretStream`. Throws if any
  * chunk fails authentication, if data follows the `TAG_FINAL` chunk, or if the
- * stream ends without it (truncation).
+ * stream ends without it (truncation) unless `allowMissingFinalTag` is set.
  */
-export async function decryptSecretStream(key, data, progress, signal) {
+export async function decryptSecretStream(key, data, progress, signal, options) {
     await setup();
     const headerBytes = sodium.crypto_secretstream_xchacha20poly1305_HEADERBYTES;
     const chunkSize = CHUNK_SIZE + sodium.crypto_secretstream_xchacha20poly1305_ABYTES;
@@ -186,7 +189,7 @@ export async function decryptSecretStream(key, data, progress, signal) {
                 lastPercent = percent;
             }
         }
-        if (!finalTagSeen) {
+        if (!finalTagSeen && options?.allowMissingFinalTag !== true) {
             throw new Error('Unable to decrypt the data: the data is truncated!');
         }
         void progress?.({

package/dist/lib/crypto/domain.js

@@ -11,11 +11,12 @@ import { concatenate } from '../utils/array.js';
  */
 export async function encryptDataAndKey({ data, currentIdentity, keyPairs, progress, signal, }) {
     const dataKey = secretStreamKeygen();
-    const { data: encryptedData, md5Encrypted } = await encrypt(dataKey, data, progress, signal);
+    const { data: encryptedData, md5: md5Data, md5Encrypted, } = await encrypt(dataKey, data, progress, signal);
     if (!currentIdentity || !keyPairs) {
         return {
             encryptedData,
             dataKey,
+            md5Data,
             md5Encrypted,
         };
     }
@@ -28,6 +29,7 @@ export async function encryptDataAndKey({ data, currentIdentity, keyPairs, progr
         encryptedDataKey: encDataKey,
         encryptedData,
         dataKey,
+        md5Data,
         md5Encrypted,
     };
 }

package/dist/lib/crypto/helpers.js

@@ -17,11 +17,19 @@ export function encryptKeyWithPassword(key, password) {
     const salt = sodium.randombytes_buf(sodium.crypto_pwhash_SALTBYTES);
     return concatenate(new Uint8Array([PASSWORD_KEY_VERSION]), salt, encryptSecretBox(key, derivePassword(password, salt)));
 }
-/** Unwrap a data key produced by `encryptKeyWithPassword`. */
-export function decryptKeyWithPassword(wrapped, password) {
+/**
+ * Unwrap a data key produced by `encryptKeyWithPassword`. Also reads the
+ * legacy format (`nonce || secretbox(key)`) whose salt was derived from the
+ * password and the plaintext md5, hence `legacyMd5`.
+ */
+export function decryptKeyWithPassword(wrapped, password, legacyMd5) {
     const boxBytes = sodium.crypto_secretbox_NONCEBYTES +
         sodium.crypto_secretbox_MACBYTES +
         sodium.crypto_secretstream_xchacha20poly1305_KEYBYTES;
+    if (wrapped.byteLength === boxBytes) {
+        const salt = sodium.crypto_generichash(sodium.crypto_pwhash_SALTBYTES, password + legacyMd5, null);
+        return decryptSecretBox(wrapped, derivePassword(password, salt));
+    }
     if (wrapped.byteLength === 1 + sodium.crypto_pwhash_SALTBYTES + boxBytes &&
         wrapped[0] === PASSWORD_KEY_VERSION) {
         const salt = wrapped.slice(1, 1 + sodium.crypto_pwhash_SALTBYTES);

package/dist/lib/crypto/index.js

@@ -1,5 +1,12 @@
 import { concatenate } from '../utils/array.js';
 import { sodium } from '../sodium.js';
+function dataTooShortError() {
+    return {
+        name: 'ClientError',
+        code: 'DATA_TOO_SHORT',
+        message: 'Encrypted payload is shorter than nonce + MAC',
+    };
+}
 export function encryptCryptoBox(data, publicKeyBob, privateKeyAlice) {
     const nonce = sodium.randombytes_buf(sodium.crypto_box_NONCEBYTES);
     const crypt = sodium.crypto_box_easy(data, nonce, sodium.from_hex(publicKeyBob), sodium.from_hex(privateKeyAlice));
@@ -10,7 +17,7 @@ export function generateCryptoBoxKeyPair() {
 }
 export function decryptCryptoBox(data, publicKeyAlice, privateKeyBob) {
     if (data.length < sodium.crypto_box_NONCEBYTES + sodium.crypto_box_MACBYTES) {
-        throw new Error('data too short');
+        throw dataTooShortError();
     }
     const nonce = data.slice(0, sodium.crypto_box_NONCEBYTES);
     const cipher = data.slice(sodium.crypto_box_NONCEBYTES);
@@ -27,7 +34,7 @@ export function encryptSecretBox(data, key) {
 export function decryptSecretBox(data, key) {
     if (data.length <
         sodium.crypto_secretbox_NONCEBYTES + sodium.crypto_secretbox_MACBYTES) {
-        throw new Error('data too short');
+        throw dataTooShortError();
     }
     const nonce = data.slice(0, sodium.crypto_secretbox_NONCEBYTES);
     const cipher = data.slice(sodium.crypto_secretbox_NONCEBYTES);

package/dist/lib/versioning.js

@@ -1 +1 @@
-export const SECRECY_LIB_VERSION = '0.0.0-development';
+export const SECRECY_LIB_VERSION = '1.86.4-fix-crypto.1';