Is JsCrypto.Word32Array.random(8) same as crypto.randomBytes(8).toString("hex") in terms of cryptographically strong random generation?

The package size on npm is around 1mb can we reduce it?

I know you're probably not working on this anymore, but I'm hoping you'll at least see this message and might have an idea where I can look.

I'm trying to decrypt data using AES GCM. I can do this in node js perfectly fine and I've almost got it working in your library. I can authenticate the data and key using the AAD and tag, which works great. Then I can decrypt the payload, but it never decrypts the whole message, only a small part.

Full disclosure, I'm trying to decrypt the broadcast messages from Tuya devices, so I can (eventually) use them in an app called SignalRGB. I know how to do this in NodeJS, but their app only supports limited JS. So that's why I'm here. Your library is the only one so far that has been able to decrypt at least part of the data.

Here's a test script, assuming you import AES, MD5, GCM, Hex and Base64

const aad = Hex.parse('00000000000000000013000000f1');
const tag = Hex.parse('36521b69183234690ed71b27fea429b5');

const key = MD5.hash('yGAdlopoPVldABfn');
const payloadBase64 = 'gkfGIQ1HGkmfHBwFqN9mtmz0bWGMVIhllyfMdXM0GnnEu4FYtSeSVumBoNg6yQ0Zvy6vzZhrjpLheWVHwVrytFj1GXNqesVv2u0lyTuaaKtt41epfZbTJ53CUMCFiOyXBjJZlFzHDLVWdwNd6697JT5WVclT8LML7dQ1ZCRJ2RTRoccqa+qbXPtkuyknC6EqwfttCOlshpOB6eKNf0+mG8ZKPIAFIGKIorI/OZgsGy5o4sijBtbJzh9jGQQCp2hPwc57PXqmCnmzA7kvYJkt9XFW+DCS';
const payload = Base64.parse(payloadBase64);

const iv = Hex.parse('7dc8a528c958e1359c7b08ad');

var authtag = GCM.mac(AES, key, iv, aad, payload);

// Let's see if the data is correct
if (authtag.toString() !== tag.toString())
{
    console.log('Error authenticating data');
} else
{
    console.log('Key and data is valid');
    console.log(payload);
    console.log(payload.toString(Base64));

    let decrypted = AES.decrypt(payload.toString(Base64), key, {iv: iv, mode: GCM});
    console.log('Decrypted', decrypted);   
}

This is a 213 byte long encrypted json message. If I decrypt it in node js, it gives me exactly that. A 213 byte decrypted json message. When I use your library it gives me, in this case, 15 bytes of the decrypted json message. So it does decrypt correctly, it just stops randomly.

I have other examples where the library decrypts more, but never the full message. Do you have any clue where I should look?

Best regards,
Rick

Javascript code

var salt = JsCrypto.Utf8.parse("abcd");
var iv = JsCrypto.Utf8.parse("DuWObJpjGijl6mxB");

var password = "0Usd2xqrLnjXJjcMKFb2T6SrWTag8FSXzAIfnHCIY24="
var plainText = "test";

var keySize = 256;
var iterations = 1;
var options = {
iv: iv,
mode: JsCrypto.mode.GCM,
padding: JsCrypto.pad.Pkcs7,
}

function generateKey(passphrase, salt) {
var key = JsCrypto.PBKDF2.getKey(
passphrase ,
salt,
{ keySize: keySize, iterations: iterations }
);
return key;
}

function encrypt(word) {
var key1= generateKey(password,salt);
var encrypted = JsCrypto.AES.encrypt(word, key1, options);
return encrypted.cipherText.toString(JsCrypto.Base64);
// return ciphertext.toString();
}

function decrypt(word) {
var key1= generateKey(password,salt);
var decrypt = JsCrypto.AES.decrypt(word, key1, options);
return JsCrypto.Utf8.stringify(decrypt).toString();
}

var encryptTxt = encrypt(plainText);
console.log(encryptTxt)

var decryptTxt = decrypt(encryptTxt);

console.log(decryptTxt)

Output
nj0XaL1LnSgQHw/bCFW/2A==
test

Java Code
import javax.crypto.Cipher;
import javax.crypto.SecretKey;
import javax.crypto.SecretKeyFactory;
import javax.crypto.spec.GCMParameterSpec;
import javax.crypto.spec.PBEKeySpec;
import javax.crypto.spec.SecretKeySpec;
import java.nio.charset.Charset;
import java.nio.charset.StandardCharsets;
import java.security.spec.KeySpec;
import java.util.Base64;

public class NewGcmTry {
private static final String DEFAULT_CIPHER_ALGORITHM = "AES/GCM/NoPadding";
private static final int GCM_TAG_LENGTH = 128;
private static final int GCM_IV_LENGTH = 12;
private static final int SALT_LENGTH = 16;
private static final Charset UTF_8 = StandardCharsets.UTF_8;

public static String encrypt(byte[] pText, String password) {
    try {
        byte[] salt = "abcd".getBytes();
        byte[] iv = "DuWObJpjGijl6mxB".getBytes();

      SecretKey aesKeyFromPassword = getSecretKey(password.toCharArray(),salt);

        Cipher cipher = Cipher.getInstance(DEFAULT_CIPHER_ALGORITHM);
        GCMParameterSpec gcmParameterSpec = new GCMParameterSpec(GCM_TAG_LENGTH, iv);
        cipher.init(Cipher.ENCRYPT_MODE,aesKeyFromPassword ,gcmParameterSpec);
        byte[] result = cipher.doFinal(pText);
        return Base64.getEncoder().encodeToString(result);
    } catch (Exception ex) {
        System.out.println(ex);

// logger.error("encrypt error", ex);
}
return null;
}

public static void main(String[] args) {
     String password = "0Usd2xqrLnjXJjcMKFb2T6SrWTag8FSXzAIfnHCIY24=";
     String plainText = "test";
    String encrypt = NewGcmTry.encrypt(plainText.getBytes(StandardCharsets.UTF_8), password);
    System.out.println(encrypt);
}


private static SecretKey getSecretKey(char[] password, byte[] salt) {
    try {

        SecretKeyFactory factory = SecretKeyFactory.getInstance("PBKDF2WithHmacSHA256");
        KeySpec spec = new PBEKeySpec(password, salt, 1, 256); //65536
        SecretKey secret = new SecretKeySpec(factory.generateSecret(spec).getEncoded(), "AES");
        return secret;
    } catch (Exception ex) {
        System.out.println(ex);
    }
    return null;
}

}

Output
BYY3sot+nIXRX0x3a52OW55/kVg=

Kindly help to find similar code for java also.

I wanted to created encrypted text in Javascript and decrypt in Java.

Thanks in advance !

While decryption am getting the half of the encrypted data only... compared to the .NET BouncyCastle GCM encryption...
In BouncyCastle am getting encrypted data having length 32 whereas in the jsCrypto am getting 16...
i cant get the references in the document that provided either in npm js or in the gist...

Here is the configuration...
let encryptedData = jsCrypto.AES.encrypt(
msg,
key,{
iv:iv,
mode: jsCrypto.mode.GCM,
padding: jsCrypto.pad.NoPadding
}
);

Without this, more strict bundlers and Node's ESM mode won't be able to import the es6 build of jscrypto.

e.g. From vitest:

SyntaxError: Cannot use import statement outside a module
Module .../node_modules/.pnpm/[email protected]/node_modules/jscrypto/es6/lib/random.js:1 seems to be an ES Module but shipped in a CommonJS package. You might want to create an issue to the package "jscrypto" asking them to ship the file in .mjs extension or add "type": "module" in their package.json.