Added environment: 'browser' to NodeRSA instances as workaround for CVE.

This change may make the encryption/decryption slower but it's necessary until Node supports SSL 3.2+

Author: jlkalberer

package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "@brewskey/spark-server",
-  "version": "1.0.11",
+  "version": "1.0.12",
   "license": "AGPL-3.0",
   "repository": {
     "type": "git",
@@ -144,4 +144,4 @@
     "@nx/nx-linux-x64-musl": "16.8.1",
     "@nx/nx-win32-x64-msvc": "16.8.1"
   }
-}
+}

package.json

@@ -7,6 +7,7 @@
     "start": "ts-node ./src/index.ts",
     "build": "tsc --noEmit"
   },
+  "private": "true",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/Brewskey/particle-collider.git"
@@ -29,4 +30,4 @@
     "ts-node": "^10.9.2",
     "typescript": "^5.3.3"
   }
-}
+}

packages/particle-collider/package.json

@@ -22,20 +22,24 @@ class CryptoManager {
     CryptoManager._serverKey = new NodeRSA(keyString, 'pkcs8-public-pem', {
       encryptionScheme: 'pkcs1',
       signingScheme: 'pkcs1',
+      environment: 'browser',
     });
   }
 
   static loadPrivateKey(keyString: string): NodeRSA {
     return new NodeRSA(keyString, undefined, {
       encryptionScheme: 'pkcs1',
       signingScheme: 'pkcs1',
+      environment: 'browser',
     });
   }
 
   static createKey(): NodeRSA {
-    return new NodeRSA({
+    const rsa = new NodeRSA({
       b: 1024,
     });
+    rsa.setOptions({ environment: 'browser' }); //By default it will use the node crypto library with the CVE
+    return rsa;
   }
 
   static randomBytes(count: number): Buffer {

packages/particle-collider/src/lib/CryptoManager.ts

@@ -1,6 +1,6 @@
 {
   "name": "@brewskey/spark-protocol",
-  "version": "1.0.11",
+  "version": "1.0.12",
   "main": "./dist/index.js",
   "repository": {
     "type": "git",
@@ -89,4 +89,4 @@
     "ts-node": "^10.9.2",
     "typescript": "^5.3.3"
   }
-}
+}

packages/spark-protocol/package.json

@@ -55,6 +55,7 @@ class CryptoManager {
 
   async _createServerKeys(): Promise<NodeRSA> {
     const privateKey = new NodeRSA({ b: 2048 });
+    privateKey.setOptions({ environment: 'browser' }); //By default it will use the node crypto library with the CVE
 
     await this._serverKeyRepository.createKeys(
       Buffer.from(privateKey.exportKey('pkcs1-private-pem')),
@@ -74,6 +75,7 @@ class CryptoManager {
     return new NodeRSA(privateKeyString, undefined, {
       encryptionScheme: 'pkcs1',
       signingScheme: 'pkcs1',
+      environment: 'browser',
     });
   }
 
@@ -114,6 +116,7 @@ class CryptoManager {
     try {
       return this._serverPrivateKey.decrypt(data);
     } catch (error) {
+      console.error(error);
       return null;
     }
   }

packages/spark-protocol/src/lib/CryptoManager.ts

@@ -11,6 +11,7 @@ class DeviceKey {
       this._nodeRsa = new NodeRSA(pemString, 'pkcs8-public-pem', {
         encryptionScheme: 'pkcs1',
         signingScheme: 'pkcs1',
+        environment: 'browser',
       });
     } catch (_) {
       this._ecKey = new ECKey(pemString, 'pem');

packages/spark-protocol/src/lib/DeviceKey.ts

@@ -212,7 +212,6 @@ class Handshake {
     deviceProvidedPem: string | null | undefined;
   }> {
     const decryptedHandshakeData = this._cryptoManager.decrypt(data);
-
     if (!decryptedHandshakeData) {
       throw new Error(
         'handshake data decryption failed. ' +
@@ -252,6 +251,7 @@ class Handshake {
 
     const deviceProvidedPem = this._convertDERtoPEM(deviceKeyBuffer);
     const deviceID = deviceIDBuffer.toString('hex');
+    console.log('decrypted', { deviceID, deviceProvidedPem });
 
     return { deviceID, deviceProvidedPem };
   }

packages/spark-protocol/src/lib/Handshake.ts

@@ -14,7 +14,8 @@ import { CoreOptions, UrlOptions } from 'request';
 const WEBHOOK_BASE: Webhook = {
   event: 'test-event',
   requestType: 'POST',
-  url: 'https://webhook.site/7d7dff97-b980-4d36-a4ed-ac7e94cc0c0f',
+  // TODO - use supertest or something for a mock server. This API will break whenever they decide to clean up old webhooks
+  url: 'https://webhook.site/fb2d5641-92c6-4b1d-9df9-4fbccfd22aa6',
   created_at: new Date(),
   id: 'test-id',
   ownerID: 'test-owner-id',

src/__tests__/WebhookManager.test.ts

@@ -65,6 +65,7 @@ class TestData {
 
   static getPublicKey: () => string = (): string => {
     const key = new NodeRSA({ b: 1024 });
+    key.setOptions({ environment: 'browser' }); //By default it will use the node crypto library with the CVE
 
     return key.exportKey('pkcs8-public-pem');
   };