@@ -14,35 +14,31 @@ export async function encryptWithAESGCM(
1414 keyBase64 : string ,
1515 ivBase64 : string
1616) : Promise < string > {
17- try {
18- // Convert base64 to forge-compatible format
19- const key = forge . util . decode64 ( keyBase64 ) ;
20- const iv = forge . util . decode64 ( ivBase64 ) ;
17+ // Convert base64 to forge-compatible format
18+ const key = forge . util . decode64 ( keyBase64 ) ;
19+ const iv = forge . util . decode64 ( ivBase64 ) ;
2120
22- // Create AES-GCM cipher
23- const cipher = forge . cipher . createCipher ( 'AES-GCM' , key ) ;
21+ // Create AES-GCM cipher
22+ const cipher = forge . cipher . createCipher ( 'AES-GCM' , key ) ;
2423
25- // Start encryption with IV
26- cipher . start ( { iv } ) ;
24+ // Start encryption with IV
25+ cipher . start ( { iv : forge . util . createBuffer ( iv ) } ) ;
2726
28- // Update with plaintext
29- cipher . update ( forge . util . createBuffer ( plaintext , 'utf8' ) ) ;
27+ // Update with plaintext
28+ cipher . update ( forge . util . createBuffer ( plaintext , 'utf8' ) ) ;
3029
31- // Finish encryption
32- cipher . finish ( ) ;
30+ // Finish encryption
31+ cipher . finish ( ) ;
3332
34- // Get ciphertext and auth tag
35- const ciphertext = cipher . output . getBytes ( ) ;
36- const authTag = cipher . mode . tag . getBytes ( ) ;
33+ // Get ciphertext and auth tag
34+ const ciphertext = cipher . output . getBytes ( ) ;
35+ const authTag = cipher . mode . tag . getBytes ( ) ;
3736
38- // Combine ciphertext + auth tag (Web Crypto API format)
39- const encryptedWithTag = ciphertext + authTag ;
37+ // Combine ciphertext + auth tag (Web Crypto API format)
38+ const encryptedWithTag = ciphertext + authTag ;
4039
41- // Convert to base64
42- return forge . util . encode64 ( encryptedWithTag ) ;
43- } catch ( error ) {
44- throw new Error ( `AES-GCM encryption failed: ${ error } ` ) ;
45- }
40+ // Convert to base64
41+ return forge . util . encode64 ( encryptedWithTag ) ;
4642}
4743
4844/**
@@ -53,48 +49,43 @@ export async function decryptWithAESGCM(
5349 keyBase64 : string ,
5450 ivBase64 : string
5551) : Promise < string > {
56- try {
57- // Convert base64 to forge-compatible format
58- const key = forge . util . decode64 ( keyBase64 ) ;
59- const iv = forge . util . decode64 ( ivBase64 ) ;
60- const encryptedDataWithTag = forge . util . decode64 ( encryptedBase64 ) ;
61-
62- // For node-forge GCM, we need to manually handle the auth tag
63- // Web Crypto API embeds the auth tag at the end of the encrypted data
64- const tagLength = ENCRYPTION_CONFIG . GCM_TAG_LENGTH ;
65-
66- if ( encryptedDataWithTag . length < tagLength ) {
67- throw new Error (
68- `Encrypted data too short for GCM (${ encryptedDataWithTag . length } bytes, need at least ${ tagLength } )`
69- ) ;
70- }
71-
72- // Split the data: ciphertext + auth tag (last 16 bytes)
73- const ciphertext = encryptedDataWithTag . slice ( 0 , - tagLength ) ;
74- const authTag = encryptedDataWithTag . slice ( - tagLength ) ;
75-
76- // Create AES-GCM decipher
77- const decipher = forge . cipher . createDecipher ( 'AES-GCM' , key ) ;
78-
79- // Start decryption with IV and auth tag
80- decipher . start ( {
81- iv,
82- tag : authTag ,
83- } ) ;
84-
85- // Update with ciphertext
86- decipher . update ( forge . util . createBuffer ( ciphertext ) ) ;
87-
88- // Finish and verify auth tag
89- const success = decipher . finish ( ) ;
90-
91- if ( ! success ) {
92- throw new Error ( 'GCM authentication failed - auth tag verification failed' ) ;
93- }
94-
95- const decryptedText = decipher . output . toString ( 'utf8' ) ;
96- return decryptedText ;
97- } catch ( error ) {
98- throw new Error ( `AES-GCM decryption failed: ${ error } ` ) ;
52+ // Convert base64 to forge-compatible format
53+ const key = forge . util . decode64 ( keyBase64 ) ;
54+ const iv = forge . util . decode64 ( ivBase64 ) ;
55+ const encryptedDataWithTag = forge . util . decode64 ( encryptedBase64 ) ;
56+
57+ // For node-forge GCM, we need to manually handle the auth tag
58+ // Web Crypto API embeds the auth tag at the end of the encrypted data
59+ const tagLength = ENCRYPTION_CONFIG . GCM_TAG_LENGTH ;
60+
61+ if ( encryptedDataWithTag . length < tagLength ) {
62+ throw new Error (
63+ `Encrypted data too short for GCM (${ encryptedDataWithTag . length } bytes, need at least ${ tagLength } )`
64+ ) ;
9965 }
66+
67+ // Split the data: ciphertext + auth tag (last 16 bytes)
68+ const ciphertext = encryptedDataWithTag . slice ( 0 , - tagLength ) ;
69+ const authTag = encryptedDataWithTag . slice ( - tagLength ) ;
70+
71+ // Create AES-GCM decipher
72+ const decipher = forge . cipher . createDecipher ( 'AES-GCM' , key ) ;
73+
74+ // Start decryption with IV and auth tag
75+ decipher . start ( {
76+ iv : forge . util . createBuffer ( iv ) ,
77+ tag : forge . util . createBuffer ( authTag ) ,
78+ } ) ;
79+
80+ // Update with ciphertext
81+ decipher . update ( forge . util . createBuffer ( ciphertext ) ) ;
82+
83+ // Finish and verify auth tag
84+ const success = decipher . finish ( ) ;
85+
86+ if ( ! success ) {
87+ throw new Error ( 'GCM authentication failed - auth tag verification failed' ) ;
88+ }
89+
90+ return decipher . output . toString ( ) ;
10091}
0 commit comments