Skip to content

Fixed the key Leak Issue #246

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
YATIN072007 wants to merge 5 commits into from
Closed

Fixed the key Leak Issue #246

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
2fa2077
Use canonical link for all RFC references (#189)
YATIN072007 Jan 18, 2026
278a333
Refactor Dartdoc examples to be self-contained
YATIN072007 Jan 20, 2026
2b34a85
Hide the key for JSON Web Key in webcrypto.aesctr.dart
YATIN072007 Jan 24, 2026
fbf03f7
Replace sample private key with placeholder text
YATIN072007 Jan 24, 2026
ca4a9c1
Merge branch 'YATIN072007-patch-Patch-holder-Key-hiding' into YATIN07…
YATIN072007 Jan 24, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion lib/src/testing/webcrypto/pbkdf2.dart
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -75,7 +75,7 @@ void main() async {
await runner.tests().runTests();
}

// TODO: Augments tests with test vectors from: https://datatracker.ietf.org/doc/html/rfc6070
// TODO: Augments tests with test vectors from: https://www.rfc-editor.org/rfc/rfc6070

// Allow single quotes for hardcoded testData written as JSON:
// ignore_for_file: prefer_single_quotes
Expand Down
2 changes: 1 addition & 1 deletion lib/src/testing/webcrypto/rsapss.dart
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -130,7 +130,7 @@ final _testData = [
/// [3]: https://opensource.apple.com/source/xnu/xnu-4570.41.2/EXTERNAL_HEADERS/corecrypto/ccrsa.h.auto.html
/// [4]: https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-4.pdf
/// [5]: https://www.rfc-editor.org/rfc/rfc3447
/// [6]: https://tools.ietf.org/html/rfc3447#section-9.1
/// [6]: https://www.rfc-editor.org/rfc/rfc3447#section-9.1
/// [7]: https://bugs.webkit.org/show_bug.cgi?id=216750
...(nullOnSafari(_testDataWithLongSaltLength) ?? <Map>[]),
];
Expand Down
159 changes: 88 additions & 71 deletions lib/src/webcrypto/webcrypto.aescbc.dart
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,8 +32,8 @@ part of 'webcrypto.dart';
/// {@macro AesCbcSecretKey-encryptBytes/decryptBytes:example}
///
/// [1]: https://csrc.nist.gov/publications/detail/sp/800-38a/final
/// [2]: https://tools.ietf.org/html/rfc2315#section-10.3
/// [3]: https://tools.ietf.org/html/rfc7517
/// [2]: https://www.rfc-editor.org/rfc/rfc2315#section-10.3
/// [3]: https://www.rfc-editor.org/rfc/rfc7517
final class AesCbcSecretKey {
final AesCbcSecretKeyImpl _impl;

Expand All @@ -56,19 +56,21 @@ final class AesCbcSecretKey {
/// import 'dart:typed_data' show Uint8List;
/// import 'package:webcrypto/webcrypto.dart';
///
/// final rawKey = Uint8List(16);
/// fillRandomBytes(rawKey);
/// Future<void> main() async {
/// final rawKey = Uint8List(16);
/// fillRandomBytes(rawKey);
///
/// final k = await AesCbcSecretKey.importRawKey(rawKey);
/// final k = await AesCbcSecretKey.importRawKey(rawKey);
///
/// // Use a unique IV for each message.
/// final iv = Uint8List(16);
/// fillRandomBytes(iv);
/// // Use a unique IV for each message.
/// final iv = Uint8List(16);
/// fillRandomBytes(iv);
///
/// // Encrypt a message
/// final c = await k.encryptBytes(utf8.encode('hello world'), iv);
/// // Encrypt a message
/// final c = await k.encryptBytes(utf8.encode('hello world'), iv);
///
/// print(utf8.decode(await k.decryptBytes(c, iv))); // hello world
/// print(utf8.decode(await k.decryptBytes(c, iv))); // hello world
/// }
/// ```
static Future<AesCbcSecretKey> importRawKey(List<int> keyData) async {
final impl = await webCryptImpl.aesCbcSecretKey.importRawKey(keyData);
Expand All @@ -95,18 +97,20 @@ final class AesCbcSecretKey {
/// import 'dart:convert' show jsonEncode, jsonDecode;
/// import 'package:webcrypto/webcrypto.dart';
///
/// // JSON Web Key as a string containing JSON.
/// final jwk = '{"kty": "oct", "alg": "A256CBC", "k": ...}';
/// Future<void> main() async {
/// // JSON Web Key as a string containing JSON.
/// final jwk = '{"kty": "oct", "alg": "A256CBC", "k": "Y0ztPO2iDca0H0iM6y0_s0ztPO2iDca0H0iM6y0_s0w"}';
///
/// // Import secret key from decoded JSON.
/// final key = await AesCbcSecretKey.importJsonWebKey(jsonDecode(jwk));
/// // Import secret key from decoded JSON.
/// final key = await AesCbcSecretKey.importJsonWebKey(jsonDecode(jwk));
///
/// // Export the key (print it in same format as it was given).
/// Map<String, dynamic> keyData = await key.exportJsonWebKey();
/// print(jsonEncode(keyData));
/// // Export the key (print it in same format as it was given).
/// Map<String, dynamic> keyData = await key.exportJsonWebKey();
/// print(jsonEncode(keyData));
/// }
/// ```
///
/// [1]: https://tools.ietf.org/html/rfc7517
/// [1]: https://www.rfc-editor.org/rfc/rfc7517
// TODO: Decide if we want restrictions on "use" property" (we probably have it on web, if we don't strip it)
// TODO: Decide if we want place restrictions on key_ops
static Future<AesCbcSecretKey> importJsonWebKey(
Expand All @@ -129,8 +133,10 @@ final class AesCbcSecretKey {
/// ```dart
/// import 'package:webcrypto/webcrypto.dart';
///
/// // Generate a new random AES-CBC secret key for AES-256.
/// final key = await AesCbcSecretKey.generate(256);
/// Future<void> main() async {
/// // Generate a new random AES-CBC secret key for AES-256.
/// final key = await AesCbcSecretKey.generateKey(256);
/// }
/// ```
static Future<AesCbcSecretKey> generateKey(int length) async {
final impl = await webCryptImpl.aesCbcSecretKey.generateKey(length);
Expand All @@ -151,7 +157,7 @@ final class AesCbcSecretKey {
///
/// {@template AesCbcSecretKey-encrypt:padding}
/// Encrypted output is always padded in PKCS#7 mode, as described in
/// [RFC 2315 Section 10.3 step 2](https://tools.ietf.org/html/rfc2315#section-10.3).
/// [RFC 2315 Section 10.3 step 2](https://www.rfc-editor.org/rfc/rfc2315#section-10.3).
/// This padding is stripped when the message is decrypted.
/// {@endtemplate}
///
Expand All @@ -162,18 +168,20 @@ final class AesCbcSecretKey {
/// import 'dart:typed_data' show Uint8List;
/// import 'package:webcrypto/webcrypto.dart';
///
/// // Generate a new random AES-CBC secret key for AES-256.
/// final k = await AesCbcSecretKey.generate(256);
/// Future<void> main() async {
/// // Generate a new random AES-CBC secret key for AES-256.
/// final k = await AesCbcSecretKey.generateKey(256);
///
/// // Use a unique IV for each message.
/// final iv = Uint8List(16);
/// fillRandomBytes(iv);
/// // Use a unique IV for each message.
/// final iv = Uint8List(16);
/// fillRandomBytes(iv);
///
/// // Encrypt a message
/// final c = await k.encryptBytes(utf8.encode('hello world'), iv);
/// // Encrypt a message
/// final c = await k.encryptBytes(utf8.encode('hello world'), iv);
///
/// // Decrypt message (requires the same iv)
/// print(utf8.decode(await k.decryptBytes(c, iv))); // hello world
/// // Decrypt message (requires the same iv)
/// print(utf8.decode(await k.decryptBytes(c, iv))); // hello world
/// }
/// ```
/// {@endtemplate}
///
Expand All @@ -197,28 +205,32 @@ final class AesCbcSecretKey {
/// import 'package:async/async.dart' show collectBytes;
/// import 'package:webcrypto/webcrypto.dart';
///
/// // Generate a new random AES-CBC secret key for AES-256.
/// final k = await AesCbcSecretKey.generate(256);
///
/// // Use a unique IV for each message.
/// final iv = Uint8List(16);
/// fillRandomBytes(iv);
///
/// // Encrypt a message from file and write to file
/// final inputFile = File('message.txt');
/// final encryptedFile = File('encrypted-message.binary');
/// final c = await k.encryptStream(
/// inputFile.openRead(),
/// iv,
/// ).pipe(encryptedFile.openWrite());
///
/// // Decrypt message (requires the same iv)
/// final decryptedBytes = await collectBytes(k.decryptStream(
/// encryptedFile.openRead(),
/// iv, // same iv as used for encryption
/// ));
/// // decryptedBytes should be equal to contents of inputFile
/// assert(utf8.decode(decryptedBytes) == inputFile.readAsStringSync());
/// Future<void> main() async {
/// // Generate a new random AES-CBC secret key for AES-256.
/// final k = await AesCbcSecretKey.generateKey(256);
///
/// // Use a unique IV for each message.
/// final iv = Uint8List(16);
/// fillRandomBytes(iv);
///
/// // Encrypt a message from file and write to file
/// final inputFile = File('message.txt');
/// await inputFile.writeAsString('hello world');
/// final encryptedFile = File('encrypted-message.binary');
/// await k.encryptStream(
/// inputFile.openRead(),
/// iv,
/// ).pipe(encryptedFile.openWrite());
///
/// // Decrypt message (requires the same iv)
/// final decryptedBytes = await collectBytes(k.decryptStream(
/// encryptedFile.openRead(),
/// iv, // same iv as used for encryption
/// ));
/// // decryptedBytes should be equal to contents of inputFile
/// // assert(utf8.decode(decryptedBytes) == inputFile.readAsStringSync());
/// print(utf8.decode(decryptedBytes));
/// }
/// ```
/// {@endtemplate}
///
Expand All @@ -238,7 +250,7 @@ final class AesCbcSecretKey {
/// {@template AesCbcSecretKey-decrypt:padding}
/// The encrypted [data] is always assumed to be padded in PKCS#7 mode,
/// as described in
/// [RFC 2315 Section 10.3 step 2](https://tools.ietf.org/html/rfc2315#section-10.3).
/// [RFC 2315 Section 10.3 step 2](https://www.rfc-editor.org/rfc/rfc2315#section-10.3).
/// This padding is stripped from the decrypted return value.
/// The [encryptBytes] and [encryptStream] methods always apply this padding.
/// {@endtemplate}
Expand Down Expand Up @@ -269,18 +281,21 @@ final class AesCbcSecretKey {
/// **Example**
/// ```dart
/// import 'package:webcrypto/webcrypto.dart';
/// import 'dart:convert' show base64;
///
/// // Generate a new random AES-256 secret key.
/// final key = await AesCbcSecretKey.generate(256);
/// Future<void> main() async {
/// // Generate a new random AES-256 secret key.
/// final key = await AesCbcSecretKey.generateKey(256);
///
/// // Extract the secret key.
/// final secretBytes = await key.exportRawKey();
/// // Extract the secret key.
/// final secretBytes = await key.exportRawKey();
///
/// // Print the key as base64
/// print(base64.encode(secretBytes));
/// // Print the key as base64
/// print(base64.encode(secretBytes));
///
/// // If we wanted to we could import the key as follows:
/// // key = await AesCbcSecretKey.importRawKey(secretBytes);
/// // If we wanted to we could import the key as follows:
/// // key = await AesCbcSecretKey.importRawKey(secretBytes);
/// }
/// ```
Future<Uint8List> exportRawKey() => _impl.exportRawKey();

Expand All @@ -293,18 +308,20 @@ final class AesCbcSecretKey {
/// import 'package:webcrypto/webcrypto.dart';
/// import 'dart:convert' show jsonEncode;
///
/// // Generate a new random AES-256 secret key.
/// final key = await AesCbcSecretKey.generate(256);
/// Future<void> main() async {
/// // Generate a new random AES-256 secret key.
/// final key = await AesCbcSecretKey.generateKey(256);
///
/// // Export the secret key.
/// final jwk = await key.exportJsonWebKey();
/// // Export the secret key.
/// final jwk = await key.exportJsonWebKey();
///
/// // The Map returned by `exportJsonWebKey()` can be converted to JSON with
/// // `jsonEncode` from `dart:convert`, this will print something like:
/// // {"kty": "oct", "alg": "A256CBC", "k": ...}
/// print(jsonEncode(jwk));
/// // The Map returned by `exportJsonWebKey()` can be converted to JSON with
/// // `jsonEncode` from `dart:convert`, this will print something like:
/// // {"kty": "oct", "alg": "A256CBC", "k": ...}
/// print(jsonEncode(jwk));
/// }
/// ```
///
/// [1]: https://tools.ietf.org/html/rfc7517
/// [1]: https://www.rfc-editor.org/rfc/rfc7517
Future<Map<String, dynamic>> exportJsonWebKey() => _impl.exportJsonWebKey();
}
Loading