fix(crypto): 🐛 Validate v3 private key salt

Author: haskou

TECHNICAL_DOCUMENTATION.md

@@ -864,7 +864,7 @@ The derived key is deterministic, but encryption is not: `encrypt()` generates a
 
 #### EncryptedPrivateKey
 
-Represents an immutable password-protected private key container. New encrypted private keys use v3 with scrypt (N=16384, r=8, p=5), a 16-byte salt, a 32-byte derived key, and AES-256-GCM with a 12-byte IV and 16-byte authentication tag. The v3 `v3.scrypt.N16384.r8.p5` header is authenticated as AES-GCM AAD. The class also supports v2 (`N=16384`, `r=8`, `p=1`) and the legacy 4-part format, which decrypts with PBKDF2-SHA256 using 100000 iterations and AES-256-GCM.
+Represents an immutable password-protected private key container. New encrypted private keys use v3 with scrypt (N=16384, r=8, p=5), a strict Base64-encoded 16-byte salt, a 32-byte derived key, and AES-256-GCM with a 12-byte IV and 16-byte authentication tag. The v3 `v3.scrypt.N16384.r8.p5` header is authenticated as AES-GCM AAD. The class also supports v2 (`N=16384`, `r=8`, `p=1`) and the legacy 4-part format, which decrypts with PBKDF2-SHA256 using 100000 iterations and AES-256-GCM.
 
 The current encrypted format is: `v3.scrypt.N16384.r8.p5.salt.iv.tag.cipherText` (base64-encoded, dot-separated). v2 format: `v2.scrypt.N16384.r8.p1.salt.iv.tag.cipherText`. Legacy format: `cipherText.iv.salt.tag`.
 

src/value-objects/crypto/encrypted-private-key/EncryptedPrivateKeyV3.ts

@@ -1,5 +1,6 @@
 import { Buffer } from 'buffer';
 
+import { assert } from '../../../patterns';
 import { PrivateKey } from '../PrivateKey';
 import { SymmetricEncryptedPayload } from '../SymmetricEncryptedPayload';
 import { CryptoPassword, SymmetricKey } from '../SymmetricKey';
@@ -16,6 +17,8 @@ export class EncryptedPrivateKeyV3 extends EncryptedPrivateKeyVersion {
   private static readonly CIPHER = 'aes-256-gcm';
   private static readonly EXPECTED_PARTS = 9;
   private static readonly SYMMETRIC_PAYLOAD_VERSION = 'v1';
+  private static readonly BASE64_PATTERN =
+    /^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/;
 
   private static hasSupportedScryptParameters(parts: string[]): boolean {
     return (
@@ -39,6 +42,25 @@ export class EncryptedPrivateKeyV3 extends EncryptedPrivateKeyVersion {
     return parts.slice(0, 5).join('.');
   }
 
+  private static ensureSaltIsValid(saltB64: string): Buffer {
+    assert(
+      saltB64.length > 0 &&
+        saltB64.length % 4 === 0 &&
+        EncryptedPrivateKeyV3.BASE64_PATTERN.test(saltB64),
+      new Error('Invalid encrypted private key salt'),
+    );
+
+    const salt = Buffer.from(saltB64, 'base64');
+
+    assert(
+      salt.length === EncryptedPrivateKeyV3.SALT_ENTROPY &&
+        salt.toString('base64') === saltB64,
+      new Error('Invalid encrypted private key salt'),
+    );
+
+    return salt;
+  }
+
   private static async deriveSymmetricKey(
     password: CryptoPassword,
     salt: Buffer,
@@ -116,7 +138,7 @@ export class EncryptedPrivateKeyV3 extends EncryptedPrivateKeyVersion {
     const N = parseInt(parts[2].slice(1), 10);
     const r = parseInt(parts[3].slice(1), 10);
     const p = parseInt(parts[4].slice(1), 10);
-    const salt = Buffer.from(parts[5], 'base64');
+    const salt = EncryptedPrivateKeyV3.ensureSaltIsValid(parts[5]);
     const key = await EncryptedPrivateKeyV3.deriveSymmetricKey(password, salt, {
       N,
       p,

tests/value-objects/crypto/EncryptedPrivateKey.spec.ts

@@ -255,6 +255,36 @@ describe('EncryptedPrivateKey', () => {
       ).rejects.toThrow('Unsupported encrypted private key parameters');
     });
 
+    it('should reject invalid v3 salt base64 before deriving a key', async () => {
+      const privateKey = new PrivateKey(privatePem);
+      const encrypted = await EncryptedPrivateKey.create(privateKey, password);
+      const parts = encrypted.valueOf().split('.');
+      parts[5] = 'not-base64!';
+      const scryptSpy = jest.spyOn(CryptoDerivation, 'scryptAsync');
+
+      await expect(
+        new EncryptedPrivateKeyV3().decrypt(parts, password),
+      ).rejects.toThrow('Invalid encrypted private key salt');
+
+      expect(scryptSpy).not.toHaveBeenCalled();
+      scryptSpy.mockRestore();
+    });
+
+    it('should reject v3 salts that are not exactly 16 bytes before deriving a key', async () => {
+      const privateKey = new PrivateKey(privatePem);
+      const encrypted = await EncryptedPrivateKey.create(privateKey, password);
+      const parts = encrypted.valueOf().split('.');
+      parts[5] = Buffer.alloc(15).toString('base64');
+      const scryptSpy = jest.spyOn(CryptoDerivation, 'scryptAsync');
+
+      await expect(
+        new EncryptedPrivateKeyV3().decrypt(parts, password),
+      ).rejects.toThrow('Invalid encrypted private key salt');
+
+      expect(scryptSpy).not.toHaveBeenCalled();
+      scryptSpy.mockRestore();
+    });
+
     it('should authenticate v3 header fields with AAD', async () => {
       const privateKey = new PrivateKey(privatePem);
       const encrypted = await EncryptedPrivateKey.create(privateKey, password);