decrypt AES input on Flutter, when on web use cryptoJS AES

Question

On web, I'm using CryptoJS for decrypto JS:

CryptoJS.AES.decrypt(inputBase64, key).toString(CryptoJS.enc.Utf8);

Example:

input: "tzfwnxVwE/qNoaWRRfqLp11ZyhB4UtKO+0/Lvv5B7eE=" key: "20190225165436_15230006321670000_15510884759030000"

On flutter I can't find any library to decrypt with a key of any length.

I know "For AES, NIST selected three members of the Rijndael family, each with a block size of 128 bits, but three different key lengths: 128, 192 and 256 bits. "

But I don't know how to convert any length key to 128 bit format?

Answer 1

When you pass CryptoJS a string as the key it treats it as a passphrase and generates the key from it using a key derivation function - in this case PBKDF2. It generates a 256 bit key and a 128 bit initialization vector (IV). It then uses those for the encryption/decryption. You also need to find out what chaining method CryptoJS uses (probably cipher block chaining (CBC)) and what padding method it uses (to make sure that the plain text is a round number of 128 bit blocks - probably PKCS#7).

CryptoJS has this "works out of the box" mode, but it isn't particularly clear what it's doing under the hood - you'd need to read the source code or scour the documentation.

When trying to inter-operate between two systems/languages it's best if you remain in charge of things, rather than letting one end make arbitrary decisions. That way you can make sure that you have the settings the same at each end.

So, you might choose to:

• Use PBKDF2 to generate a 128 bit key and 128 bit IV from the string passphrase - with, say, 9999 rounds
• Use PKCS#7 padding
• Use AES in CBC mode

The pointycastle package supports all the above in Dart. It looks like CryptoJS supports all of those too.

Start with a passphrase and make sure you can generate the same key and IV in JS and Dart. Then move onto creating the ciphers.

Remember, too, never to encrypt two messages with the same key/IV pair. Use a message sequence number, for example, to slightly change the IV for each message.