Encrypt AES-GCM in JavaScript, decrypt in Java

Question

We are using the SJCL (Stanford Javascript Crypto Library) to encrypt in JavaScript and we are supposed to implement decryption in Java.

The encryption code looks like this:

<script src='https://cdnjs.cloudflare.com/ajax/libs/sjcl/1.0.7/sjcl.js'></script>

<script>
var keyString = '2d73c1dd2f6a3c981afc7c0d49d7b58f';
var key = sjcl.codec.base64.toBits(keyString);
var cipher = new sjcl.cipher.aes(key)
var data = sjcl.codec.utf8String.toBits('Hello Crypto!'); 
var salt = sjcl.codec.base64url.toBits('kLME6vN-WdU_W9XVN9a1Z3E_p8HQ5C7X1La-3ZjEml1ytVRMfvtEXzeapbce2LjFI1dHEGtWv9bZ_U6K2CG1-K4lQPunFXWxXmsTQIXlGfwmpveg2AFeLFiqGmALnfbP');
var encrypted = sjcl.encrypt(keyString,'Hello Crypto!',{mode:'gcm',salt:salt});

console.log(encrypted)
</script>

The resulting encryption looks like the following:

{
   "iv":"+xmg3yZF/LSWNFpXf03wUw==",
   "v":1,
   "iter":10000,
   "ks":128,
   "ts":64,
   "mode":"gcm",
   "adata":"",
   "cipher":"aes",
   "salt":"kLME6vN+WdU/W9XVN9a1Z3E/p8HQ5C7X1La+3ZjEml1ytVRMfvtEXzeapbce2LjFI1dHEGtWv9bZ/U6K2CG1+K4lQPunFXWxXmsTQIXlGfwmpveg2AFeLFiqGmALnfbP",
   "ct":"Nq+9tXfc0zs0/m3OfDp0MmTXc9qD"
}

We were supplied with sample Java code to decrypt the code but this code assumes that IV and salt is the same thing so it won't work with the JSON that we are getting from the JS lib (having IV and salt as two separate values):

 final byte[] symKeyData = DatatypeConverter.parseHexBinary(keyHex);
 final byte[] ivData = ivSalt.getBytes(Charset.forName("UTF-8"));
 final byte[] encryptedMessage = DatatypeConverter.parseBase64Binary(encryptedMessageString);
 final Cipher cipher = javax.crypto.Cipher.getInstance("AES/GCM/NoPadding", "BC");
 final SecretKeySpec symKey = new SecretKeySpec(symKeyData, "AES");
 final IvParameterSpec iv = new IvParameterSpec(ivData);
 cipher.init(Cipher.DECRYPT_MODE, symKey, iv);
 final byte[] encodedMessage = cipher.doFinal(encryptedMessage);
 final String message = new String(encodedMessage, Charset.forName("UTF-8"));

Can anybody explain how the resulting JSON from the JavaScript library can be decrypted correctly in Java?

Answer 1

SJCL convenience libs use PBKDF2 with 1000 iterations to derive the key. The documentation and code can be found here.

However, if this is an assignment:

• the IV is the wrong size, it should be 12 bytes, not 16;
• the salt size is way too large;
• the cipher variable in the JavaScript is entirely ignored;
• the iteration count is left at the default, which is normally considered too low.

So I don't know who wrote it, but they should not be releasing such code.

The salt is used for PBKDF2, the IV is for the symmetric cipher, so they are not the same.