backbone-hq / minibone Goto Github PK

Hey folks. I've been curious about client-side encryption and have been trying out Minibone.

I've been running into some errors when I call .decrypt() on Minibone instances. This call even fails with different error messages between different browsers, albeit from the same calls.

I'm using a client-side SvelteKit application. Creating Minibone instances, generating the payloads, and encrypting data all work fine, it's just the .decrypt method that seems to be problematic, presumably because of something lower-level in the WebCrypto API.

I've been able to get it down to the below example. I've also made a rudimentary StackBlitz example that replicates it.

const miniboneTest = async (userId: string, secretKey: string, input: string) => {
  const inMb = await Minibone.create();
  const key = await inMb.save(secretKey, ['app.my.domain', userId]);
  const enc = await inMb.encrypt({ input }, key);
  const outMb = await Minibone.load(key, secretKey, ['app.my.domain', userId]);
  const decrypted = await outMb.decrypt(enc); // Crashes here.
};

This crashes on the last .decrypt(call).

If the library isn't intended for frontend applications / browsers, or I'm invoking it incorrectly, then I'm all ears.

Interestingly the error is also different between different browsers, Chrome gives:

Uncaught (in promise) TypeError: Failed to execute 'decrypt' on 'SubtleCrypto': AesGcmParams: additionalData: Not a BufferSource.

Where Safari and Firefox give:

Unhandled Promise Rejection: OperationError: The operation failed for an operation-specific reason.

A screenshot of my playground page for this,