Skip to main content

Insecure encryption algorithm - Blowfish

Need​

Secure encryption algorithm for protecting sensitive information

Context​

  • Usage of Dart 2.0 for building high-performance, cross-platform applications
  • Usage of cipher for encrypting and decrypting data

Description​

Non compliant code​

import 'package:cipher/cipher.dart';
import 'package:cipher/impl/base.dart';

void main() {
  initCipher();

  final key = new KeyParameter(new Uint8Array.fromList([1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16]));
  final params = new ParametersWithIV(key, new Uint8Array.fromList([1,2,3,4,5,6,7,8]));
  
  final cipher = new BlockCipher('Blowfish');
  cipher.init(true, params);

  // assuming binary data
  Uint8List data = Uint8List.fromList([1,2,3,4,5,6,7,8]);
  Uint8List encryptedData = cipher.process(data);
}

The above Dart code is a simple example of using the Blowfish encryption algorithm to encrypt some data. Blowfish is a symmetric-key block cipher, which means that the same key is used for both encryption and decryption.

In the code, we first import the necessary packages. Then we initialize the cipher and define the key and the parameters for the cipher. The key is a 16-byte array, and the parameters include the key and an 8-byte initialization vector (IV).

We then create a new instance of the Blowfish cipher and initialize it with the parameters. After that, we define some data that we want to encrypt, which is an 8-byte array in this case. Finally, we use the cipher to encrypt the data.

However, this code is vulnerable because it uses the insecure Blowfish encryption algorithm. Blowfish has a block size of 64 bits, which is considered too small by today's standards. It is susceptible to birthday attacks, which can be used to find collisions in the encryption. Also, the keys used in the example are static and hard-coded, which is a bad practice as it makes the encryption easier to break.

Steps​

  • Replace the Blowfish encryption algorithm with a more secure one, such as AES (Advanced Encryption Standard).
  • Ensure that the new encryption algorithm is properly implemented in the code, replacing all instances of Blowfish.
  • Use a secure method to generate and store the encryption key. The key should be long and complex enough to prevent brute force attacks.
  • Use a secure method to generate the Initialization Vector (IV). The IV should be random and unique for each encryption operation.
  • Test the new encryption implementation to ensure it works as expected and does not introduce new vulnerabilities.

Compliant code​

import 'package:pointycastle/pointycastle.dart';
import 'dart:typed_data';
import 'dart:math';
import 'dart:convert';

void main() {
  final secureRandom = _secureRandom();

  // Generate 256-bit random key
  final key = _randomBytes(32, secureRandom);

  // Generate 128-bit random IV
  final iv = _randomBytes(16, secureRandom);

  final params = ParametersWithIV(KeyParameter(key), iv);

  // Use AES encryption
  final cipher = PaddedBlockCipher("AES/CBC/PKCS7");
  cipher.init(true, params);

  // Assuming binary data
  Uint8List data = Uint8List.fromList([1,2,3,4,5,6,7,8]);
  Uint8List encryptedData = cipher.process(data);
}

Uint8List _randomBytes(int length, SecureRandom secureRandom) {
  final key = Uint8List(length);
  for (var i = 0; i < length; i++) {
    key[i] = secureRandom.nextUint8();
  }
  return key;
}

SecureRandom _secureRandom() {
  final secureRandom = FortunaRandom();

  final random = Random.secure();
  final seeds = <int>[];
  for (var i = 0; i < 32; i++) {
    seeds.add(random.nextInt(255));
  }
  secureRandom.seed(KeyParameter(Uint8List.fromList(seeds)));

  return secureRandom;
}

The above code replaces the insecure Blowfish encryption algorithm with the more secure AES (Advanced Encryption Standard) algorithm.

The secureRandom() function is used to generate a secure random number generator, which is used to generate the encryption key and the Initialization Vector (IV). The key is 256 bits long, and the IV is 128 bits long, which are both suitable lengths for AES encryption.

The randomBytes() function is used to generate a random byte array of a specified length using the secure random number generator.

The KeyParameter and ParametersWithIV classes are used to create the parameters for the AES encryption, including the key and the IV.

The PaddedBlockCipher class is used to perform the AES encryption in CBC mode with PKCS7 padding. The init() method is used to initialize the cipher for encryption with the specified parameters, and the process() method is used to encrypt the data.

This code should be more secure than the original code, as it uses a more secure encryption algorithm and secure methods to generate the key and IV. However, it should still be tested thoroughly to ensure that it works as expected and does not introduce new vulnerabilities.

References​

Last updated on