From 7c055f71f706d68064ef2d943c49be84b2ec84c3 Mon Sep 17 00:00:00 2001 From: Daniel Hougaard Date: Fri, 8 Nov 2024 22:44:44 +0400 Subject: [PATCH] Update hsm-service.ts --- backend/src/ee/services/hsm/hsm-service.ts | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/backend/src/ee/services/hsm/hsm-service.ts b/backend/src/ee/services/hsm/hsm-service.ts index 73c4b279c..243a45276 100644 --- a/backend/src/ee/services/hsm/hsm-service.ts +++ b/backend/src/ee/services/hsm/hsm-service.ts @@ -221,7 +221,7 @@ export const hsmServiceFactory = ({ hsmModule: { isInitialized, pkcs11 } }: THsm const encryptedLength = pkcs11.C_Encrypt(sessionHandle, data, tempBuffer); // Create a copy of the encrypted data using the actual length - const encryptedData = Buffer.from(tempBuffer.slice(0, encryptedLength.length || 16)); + const encryptedData = Buffer.from(tempBuffer.subarray(0, encryptedLength.length || 16)); // Initialize HMAC const hmacMechanism = { @@ -275,7 +275,7 @@ export const hsmServiceFactory = ({ hsmModule: { isInitialized, pkcs11 } }: THsm // Split encrypted data and HMAC const hmac = encryptedDataWithHmac.subarray(-HMAC_SIZE); // Last 32 bytes are HMAC - const encryptedData = encryptedDataWithHmac.slice(0, -HMAC_SIZE); // Everything except last 32 bytes + const encryptedData = encryptedDataWithHmac.subarray(0, -HMAC_SIZE); // Everything except last 32 bytes // Find the keys const aesKey = $findKey(sessionHandle, HsmKeyType.AES); @@ -300,6 +300,7 @@ export const hsmServiceFactory = ({ hsmModule: { isInitialized, pkcs11 } }: THsm try { pkcs11.C_VerifyFinal(sessionHandle, hmac); } catch (error) { + logger.error(error, "HSM: HMAC verification failed"); throw new Error("Decryption failed"); // Generic error for failed verification }