awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-10-05 09:26:37 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update hsm-service.ts

Browse Source
This commit is contained in:
Daniel Hougaard
2024-11-11 21:47:07 +04:00
parent 14884cd6b0
commit 7c055f71f7
1 changed files with 3 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/ee/services/hsm/hsm-service.ts
+3 -2
View File
@@ -221,7 +221,7 @@ export const hsmServiceFactory = ({ hsmModule: { isInitialized, pkcs11 } }: THsm
const encryptedLength = pkcs11.C_Encrypt(sessionHandle, data, tempBuffer); const encryptedLength = pkcs11.C_Encrypt(sessionHandle, data, tempBuffer);
// Create a copy of the encrypted data using the actual length // Create a copy of the encrypted data using the actual length
const encryptedData = Buffer.from(tempBuffer.slice(0, encryptedLength.length || 16)); const encryptedData = Buffer.from(tempBuffer.subarray(0, encryptedLength.length || 16));
// Initialize HMAC // Initialize HMAC
const hmacMechanism = { const hmacMechanism = {
@@ -275,7 +275,7 @@ export const hsmServiceFactory = ({ hsmModule: { isInitialized, pkcs11 } }: THsm
// Split encrypted data and HMAC // Split encrypted data and HMAC
const hmac = encryptedDataWithHmac.subarray(-HMAC_SIZE); // Last 32 bytes are HMAC const hmac = encryptedDataWithHmac.subarray(-HMAC_SIZE); // Last 32 bytes are HMAC
const encryptedData = encryptedDataWithHmac.slice(0, -HMAC_SIZE); // Everything except last 32 bytes const encryptedData = encryptedDataWithHmac.subarray(0, -HMAC_SIZE); // Everything except last 32 bytes
// Find the keys // Find the keys
const aesKey = $findKey(sessionHandle, HsmKeyType.AES); const aesKey = $findKey(sessionHandle, HsmKeyType.AES);
@@ -300,6 +300,7 @@ export const hsmServiceFactory = ({ hsmModule: { isInitialized, pkcs11 } }: THsm
try { try {
pkcs11.C_VerifyFinal(sessionHandle, hmac); pkcs11.C_VerifyFinal(sessionHandle, hmac);
} catch (error) { } catch (error) {
logger.error(error, "HSM: HMAC verification failed");
throw new Error("Decryption failed"); // Generic error for failed verification throw new Error("Decryption failed"); // Generic error for failed verification
} }