Fix Permanent IV / IV reuse #11

Author: meld-cp

Diff for: README.md

@@ -10,7 +10,7 @@ Under the hood it uses the Advanced Encryption Standard (AES) in GCM mode.
 
 > WARNING: Use at your own risk.
 > - Your passwords are never stored anywhere, if you forget your password you can't decrypt your text.
-> - There havn't been any audits for the soundness of encryption methods being used.  Unwanted decyption by a 3rd party may still be possible if they have access to your files.
+> - There haven't been any audits for the soundness of encryption methods being used.  Unwanted decryption by a 3rd party may still be possible if they have access to your files.
 
 ## Usage
 
@@ -65,6 +65,3 @@ You can install the plugin via the Community Plugins tab within Obsidian by sear
 <a href="https://www.buymeacoffee.com/cleon"><img src="https://img.buymeacoffee.com/button-api/?text=Buy me a coffee&emoji=&slug=cleon&button_colour=FFDD00&font_colour=000000&font_family=Cookie&outline_colour=000000&coffee_colour=ffffff"></a>
 
 Thank you for your support 🙏
-
-## More information
-- [Encryption details](https://github.com/meld-cp/obsidian-encrypt/blob/main/docs/crypto-details.md)

Diff for: docs/crypto-details.md

@@ -1,8 +1,8 @@
 {
 	"id": "meld-encrypt",
 	"name": "Meld Encrypt",
-	"version": "1.3.4",
-	"minAppVersion": "0.12.12",
+	"version": "1.4.0",
+	"minAppVersion": "0.12.15",
 	"description": "Hide secrets in your notes",
 	"author": "meld-cp",
 	"authorUrl": "https://github.com/meld-cp/obsidian-encrypt",

Diff for: manifest.json

@@ -18,7 +18,7 @@
     "obsidian": "https://github.com/obsidianmd/obsidian-api.git",
     "rollup": "^2.32.1",
     "rollup-plugin-copy": "^3.4.0",
-    "tslib": "^2.0.3",
+    "tslib": "^2.3.1",
     "typescript": "^4.0.3"
   }
 }

Diff for: package.json

@@ -29,14 +29,7 @@ export default {
           src: 'dist/*',
           dest: 'test-vault/.obsidian/plugins/meld-encrypt/'
         },
-        // { src: 'assets/images/**/*', dest: 'dist/public/images' }
       ]
-      // assets: [
-      //   'dest/main.js',
-      //   'manifest.json',
-      //   'src/style.css',
-      // ],
-      // outputDir: 'test-vault/.obsidian/plugins/meld-encrypt'
     })
   ],
 

Diff for: rollup.config.js

@@ -1,11 +1,105 @@
+const vectorSize	= 16;
+const utf8Encoder	= new TextEncoder();
+const utf8Decoder	= new TextDecoder();
+const iterations	= 1000;
+const salt			= utf8Encoder.encode(navigator.userAgent);
+
+export class CryptoHelperV2 {
+
+	private async deriveKey(password:string) :Promise<CryptoKey> {
+		const buffer     = utf8Encoder.encode(password);
+		const key        = await crypto.subtle.importKey('raw', buffer, {name: 'PBKDF2'}, false, ['deriveKey']);
+		const privateKey = crypto.subtle.deriveKey(
+			{
+				name: 'PBKDF2',
+				hash: {name: 'SHA-256'},
+				iterations,
+				salt
+			},
+			key,
+			{
+				name: 'AES-GCM',
+				length: 256
+			},
+			false,
+			['encrypt', 'decrypt']
+		);
+		
+		return privateKey;
+	}
+
+	public async encryptToBase64(text: string, password: string): Promise<string> {
+
+		const key = await this.deriveKey(password);
+		
+		const textBytesToEncrypt = utf8Encoder.encode(text);
+		const vector = crypto.getRandomValues(new Uint8Array(vectorSize));
+		
+		// encrypt into bytes
+		const encryptedBytes = new Uint8Array(
+			await crypto.subtle.encrypt(
+				{name: 'AES-GCM', iv: vector},
+				key,
+				textBytesToEncrypt
+			)
+		);
+		
+		const finalBytes = new Uint8Array( vector.byteLength + encryptedBytes.byteLength );
+		finalBytes.set( vector, 0 );
+		finalBytes.set( encryptedBytes, vector.byteLength );
+
+		//convert array to base64
+		const base64Text = btoa( String.fromCharCode(...finalBytes) );
+
+		return base64Text;
+	}
+
+	private stringToArray(str: string): Uint8Array {
+		var result = [];
+		for (var i = 0; i < str.length; i++) {
+			result.push(str.charCodeAt(i));
+		}
+		return new Uint8Array(result);
+	}
+
+	public async decryptFromBase64(base64Encoded: string, password: string): Promise<string> {
+		try {
+
+			let bytesToDecode = this.stringToArray(atob(base64Encoded));
+			
+			// extract iv
+			const vector = bytesToDecode.slice(0,vectorSize);
+
+			// extract encrypted text
+			const encryptedTextBytes = bytesToDecode.slice(vectorSize);
+
+			const key = await this.deriveKey(password);
+
+			// decrypt into bytes
+			let decryptedBytes = await crypto.subtle.decrypt(
+				{name: 'AES-GCM', iv: vector},
+				key,
+				encryptedTextBytes
+			);
+
+			// convert bytes to text
+			let decryptedText = utf8Decoder.decode(decryptedBytes);
+			return decryptedText;
+		} catch (e) {
+			//console.error(e);
+			return null;
+		}
+	}
+
+}
 
-const algorithm = {
+const algorithmObsolete = {
 	name: 'AES-GCM',
 	iv: new Uint8Array([196, 190, 240, 190, 188, 78, 41, 132, 15, 220, 84, 211]),
 	tagLength: 128
 }
 
-export default class CryptoHelper {
+export class CryptoHelperObsolete {
 
 	private async buildKey(password: string) {
 		let utf8Encode = new TextEncoder();
@@ -16,7 +110,7 @@ export default class CryptoHelper {
 		let key = await crypto.subtle.importKey(
 			'raw',
 			passwordDigest,
-			algorithm,
+			algorithmObsolete,
 			false,
 			['encrypt', 'decrypt']
 		);
@@ -32,7 +126,7 @@ export default class CryptoHelper {
 
 		// encrypt into bytes
 		let encryptedBytes = new Uint8Array(await crypto.subtle.encrypt(
-			algorithm, key, bytesToEncrypt
+			algorithmObsolete, key, bytesToEncrypt
 		));
 
 		//convert array to base64
@@ -57,7 +151,7 @@ export default class CryptoHelper {
 			let key = await this.buildKey(password);
 
 			// decrypt into bytes
-			let decryptedBytes = await crypto.subtle.decrypt(algorithm, key, bytesToDecrypt);
+			let decryptedBytes = await crypto.subtle.decrypt(algorithmObsolete, key, bytesToDecrypt);
 
 			// convert bytes to text
 			let utf8Decode = new TextDecoder();

Diff for: src/CryptoHelper.ts

@@ -19,7 +19,7 @@ export default class DecryptModal extends Modal {
 		textEl.rows = 10;
 		textEl.readOnly = true;
 		//textEl.focus(); // Doesn't seem to work here...
-		setImmediate(() => { textEl.focus() }); //... but this does
+		setTimeout(() => { textEl.focus() },100); //... but this does
 
 
 		const btnContainerEl = contentEl.createDiv('');