javascript python encryption webcrypto-api pycryptodome

Pycryptodome incorrect decryption

I am generating a RSA key pair in a django view, storing the keys in db, sending the public key to the client template, encrypting a message, then sending the message to a different view where I am retrieving the private key from the db and trying to decrypt the message. When I do the decryption, I get ValueError: Incorrect decryption..

Server: Generate keys, store in db, send public key to client:

def generateKeys(request):
    store = Keys.objects.filter(pk=request.GET.get('pk'))
    serverkeypair = Crypto.PublicKey.RSA.generate(4096)
    spk = serverkeypair.publickey().exportKey(format='PEM', passphrase=None, pkcs=8, protection=None, randfunc=None)
    sprk = serverkeypair.exportKey(format='PEM', passphrase=None, pkcs=8, protection=None, randfunc=None)
    spk = spk.decode()
    store.update(spk = spk)
    store.update(sprk = sprk.decode())
    return JsonResponse(['success', spk], safe=False)

Client: Import public key, encrypt message:

fetch('../api/endpoint1/?pk='+pk, {
    method: 'GET',
    headers: { 'Content-Type': 'application/json' },
}).then(response => response.json())
  .then(async data => {
        var pbk = data[1];
        pbk = pbk.substring(27, pbk.length - 25);
        var plaintext = window.crypto.getRandomValues(new Uint8Array(64));
        console.log(btoa(ab2str(plaintext)));
        
        window.crypto.subtle.importKey(
          "spki",
          str2ab(atob(pbk)),
          {
            name: "RSA-OAEP",
            hash: "SHA-256"
          },
          true,
          ["encrypt"]
         ).then((imp_key) => {
             window.crypto.subtle.encrypt({name: 'RSA-OAEP'}, imp_key, plaintext).then((ciphertext) => {
                 ciphertext = btoa(ab2str(ciphertext));
                 console.log(ciphertext);
                 ciphertext = b64_to_b64url(ciphertext);
                 fetch('/api/endpoint2/?pk='+pk+'&ciph='+ciphertext);
             });
          });
  });


/*
Convert  an ArrayBuffer into a string
from https://developers.google.com/web/updates/2012/06/How-to-convert-ArrayBuffer-to-and-from-String
*/
function ab2str(buf) {
  return String.fromCharCode.apply(null, new Uint8Array(buf));
}


/*
Convert a string into an ArrayBuffer
from https://developers.google.com/web/updates/2012/06/How-to-convert-ArrayBuffer-to-and-from-String
*/
function str2ab(str) {
 const buf = new ArrayBuffer(str.length);
 const bufView = new Uint8Array(buf);
 for (let i = 0, strLen = str.length; i < strLen; i++) {
   bufView[i] = str.charCodeAt(i);
 }
 return buf;
}

function b64_to_b64url(s) {
    return s.replace(/\+/g, '-').replace(/\//g, '_');
}

Server: Retrieve key, decrypt message:

def decrypt(request):
    store = Keys.objects.get(pk=request.GET.get('pk'))
    sprk = getattr(store, 'sprk')
    key = RSA.importKey(sprk.encode())
    cipher = PKCS1_OAEP.new(key)
    ciphertext = request.GET.get('ciph')
    ciphertext = base64.b64decode(b64url_to_b64(ciphertext))
    plaintext = cipher.decrypt(ciphertext)
    print(plaintext)
    return JsonResponse(['success'], safe=False)

def b64url_to_b64(str):
    return str.replace('-', '+').replace('_', '/')

Test data:

Solution

Encryption and decryption apply RSA with OAEP as padding. However, in the WebCrypto code SHA-256 is explicitly specified for content and MGF1 digests, while in the PyCryptodome code the default value SHA-1 is used for both digests when instantiating the cipher object, see PKCS1_OAEP and also this post of yours.

To fix the issue, pass SHA256 as second parameter in the PyCryptodome code when instantiating the cipher object:

from Crypto.Cipher import PKCS1_OAEP
from Crypto.Hash import SHA256
...
cipher = PKCS1_OAEP.new(key, SHA256)

then decryption is successful.