CODEWITHSUNDEEP
cencryptionlibsodium
lambda
lambda

Reputation:

Encryption using libsodium

I have been struggling to encrypt/decrypt some data using crypto_secretbox_easy() in libsodium. I can't seem to find any good documentation on the usage.

I want to get a password from the user, use that to somehow make a key, then encrypt/decrypt the data using that.

The problem with the toy-code that I have posted below is that the crypto_secretbox_open_easy() returns -1 from within verify_16.c. Does anyone have any idea where I could find source showing how to use this interface or what could be going wrong? Thanks! 

 unsigned char * cipher;
 unsigned char * decoded;
 unsigned char * message;
 unsigned long long message_len = 32;
 size_t noncelen = sizeof(char) * crypto_secretbox_noncebytes();
 size_t keylen = sizeof(char) * crypto_secretbox_keybytes();
 unsigned char * nonce = calloc(noncelen, noncelen);
 unsigned char * key = calloc(keylen, keylen);

 message = calloc(32*sizeof(char), sizeof(char) * 32);
 cipher = calloc(32*sizeof(char), sizeof(char) * 32);
 decoded = calloc(32*sizeof(char), sizeof(char) * 32);

 crypto_secretbox_easy((unsigned char *)cipher, (const unsigned char *)message, 
                      message_len, nonce, key);

 crypto_secretbox_open_easy((unsigned char *)decoded, (const unsigned char *) cipher, 
                            message_len, nonce, key);

Upvotes: 0

Views: 1171

Answers (2)

Qun Li
Qun Li

Reputation: 1316

- (NSData *)encrypt:(NSData *)data nonce:(NSData *)nonce key:(NSData *)key error:(NSError **)error {
  if (!nonce || [nonce length] != NASecretBoxNonceSize) {
    if (error) *error = NAError(NAErrorCodeInvalidNonce, @"Invalid nonce");
    return nil;
  }

  if (!data) {
    if (error) *error = NAError(NAErrorCodeInvalidData, @"Invalid data");
    return nil;
  }

  if (!key || [key length] != NASecretBoxKeySize) {
    if (error) *error = NAError(NAErrorCodeInvalidKey, @"Invalid key");
    return nil;
  }

  // Add space for authentication tag of size MACBYTES
  NSMutableData *outData = [NSMutableData dataWithLength:[data length] + NASecretBoxMACSize];

  int retval = crypto_secretbox_easy([outData mutableBytes],
                                     [data bytes], [data length],
                                     [nonce bytes],
                                     [key bytes]);

  if (retval != 0) {
    if (error) *error = NAError(NAErrorCodeFailure, @"Encrypt (secret box) failed");
    return nil;
  }

  return outData;
}

- (NSData *)decrypt:(NSData *)data nonce:(NSData *)nonce key:(NSData *)key error:(NSError **)error {
  if (!nonce || [nonce length] != NASecretBoxNonceSize) {
    if (error) *error = NAError(NAErrorCodeInvalidNonce, @"Invalid nonce");
    return nil;
  }

  if (!data) {
    if (error) *error = NAError(NAErrorCodeInvalidData, @"Invalid data");
    return nil;
  }

  if (!key || [key length] != NASecretBoxKeySize) {
    if (error) *error = NAError(NAErrorCodeInvalidKey, @"Invalid key");
    return nil;
  }

  __block int retval = -1;
  NSMutableData *outData = NAData(self.secureDataEnabled, data.length, ^(void *bytes, NSUInteger length) {
    retval = crypto_secretbox_open_easy(bytes,
                                        [data bytes], [data length],
                                        [nonce bytes], [key bytes]);
  });
  if (retval != 0) {
    if (error) *error = NAError(NAErrorCodeVerificationFailed, @"Verification failed");
    return nil;
  }

  // Remove MAC bytes from data
  return [outData na_truncate:NASecretBoxMACSize];
}

Upvotes: 1

Frank Denis
Frank Denis

Reputation: 1501

The length given to crypto_secretbox_open_easy() should be the length of the authenticated/encrypted message, which is not message_len since an authentication tag is added. The length of this tag is crypto_box_MACBYTES.

Upvotes: 2

Related Questions