Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Help needed: How to Decryption to get string footer? #55

Open
NTMS2017 opened this issue Jul 3, 2018 · 2 comments
Open

Help needed: How to Decryption to get string footer? #55

NTMS2017 opened this issue Jul 3, 2018 · 2 comments

Comments

@NTMS2017
Copy link

NTMS2017 commented Jul 3, 2018

I am using flutter to send data to my aqueduct web api in encrypted mode. In aqueduct I need to use decryption to get the data, sort out request info from data base, encrypted data and send to flutter app. I couldn't find any HMAC-SHA256 Decryption so I can use the plugin in my flutter app and aqueduct web api. Any help please?

import 'dart:convert';
import 'package:crypto/crypto.dart';
import 'package:crypto/src/digest_sink.dart';

void main() {
var key = utf8.encode('p@ssw0rd');
var bytes = utf8.encode("foobar");

var hmacSha256 = new Hmac(sha256, key); // HMAC-SHA256
var digest = hmacSha256.convert(bytes);

print("HMAC digest as bytes: ${digest.bytes}");
print("HMAC digest as hex string: $digest");
}

@leocavalcante
Copy link

Well, actually, you will "never" (should) find a SHA-256 decryption library, the purpose of this hashing algorithm is one-way only, you don't have the original text back.
For password hashing this is the desired behavior, you save a hashed version of the password into the database then re-hashes the input and see if they match.
You are highly encouraged to do such hashing using proper algorithms and salts, one salt for each user so you database can be prevented from rainbow-tables: I've abstracted this fuzz at https://github.com/leocavalcante/password-dart

For encrypted communication between app (client) and api (server), that is another thing and you don't need to implement it by yourself, you can rely on TLS over HTTP, the famous HTTPS, it will handle encryption and decryption of the data begin transferred, you can add a TLS termination proxy like Nginx over Aqueduct and use something like Let’s Encrypt.

P.S.: do this password hashing thing on the server, not on the client (Flutter). so you can added more iterations over PBKDF and make the password more secure. I'm mean: scale the security by your server hardware.

@NTMS2017
Copy link
Author

NTMS2017 commented Jul 3, 2018

Thanks Leo for information. I undetstand better now. Kind Regards

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants