Secure storage overwrite fix (#1161)
* secure storage overwrite fix * add comment * bump encrypt package, use more explicit iv source --------- Co-authored-by: fossephate <fosse@book.local>
Matthew Fosse committed
Nov 15, 2023 at 11:31 UTC
062315f01b292b96edddffa30b5fa3b0e28cd128
3 files changed
+10
-10
lib/core/auth_service.dart
+5
-5
@@ -38,6 +38,9 @@ class AuthService with Store {
38
Future<void> setPassword(String password) async {
39
final key = generateStoreKeyFor(key: SecretStoreKey.pinCodePassword);
40
final encodedPassword = encodedPinCode(pin: password);
41
+ // secure storage has a weird bug on macOS, where overwriting a key doesn't work, unless
42
+ // we delete what's there first:
43
+ await secureStorage.delete(key: key);
44
await secureStorage.write(key: key, value: encodedPassword);
45
}
46
@@ -104,9 +107,8 @@ class AuthService with Store {
107
}
108
return;
109
}
107
-}
110
+ }
111
109
-
112
Navigator.of(context).pushNamed(Routes.auth,
113
arguments: (bool isAuthenticatedSuccessfully, AuthPageState auth) async {
114
if (!isAuthenticatedSuccessfully) {
@@ -140,8 +142,6 @@ class AuthService with Store {
142
}
143
}
144
}
143
-
144
- });
145
-
145
+ });
146
}
147
}
lib/entities/encrypt.dart
+4
-4
@@ -2,18 +2,18 @@ import 'package:encrypt/encrypt.dart';
2
// import 'package:password/password.dart';
3
import 'package:cake_wallet/.secrets.g.dart' as secrets;
4
5
-String encrypt({required String source, required String key, int keyLength = 16}) {
5
+String encrypt({required String source, required String key}) {
6
final _key = Key.fromUtf8(key);
7
- final iv = IV.fromLength(keyLength);
7
+ final iv = IV.allZerosOfLength(16);
8
final encrypter = Encrypter(AES(_key));
9
final encrypted = encrypter.encrypt(source, iv: iv);
10
11
return encrypted.base64;
12
}
13
14
-String decrypt({required String source, required String key, int keyLength = 16}) {
14
+String decrypt({required String source, required String key}) {
15
final _key = Key.fromUtf8(key);
16
- final iv = IV.fromLength(keyLength);
16
+ final iv = IV.allZerosOfLength(16);
17
final encrypter = Encrypter(AES(_key));
18
final decrypted = encrypter.decrypt64(source, iv: iv);
19
pubspec_base.yaml
+1
-1
@@ -49,7 +49,7 @@ dependencies:
49
lottie: ^1.3.0
50
animate_do: ^2.1.0
51
cupertino_icons: ^1.0.5
52
- encrypt: 5.0.1
52
+ encrypt: 5.0.2
53
crypto: ^3.0.2
54
# password: ^1.0.0
55
basic_utils: ^5.6.1