Aes algorithm token Decryption using Crypto Js key getting issue format Exception : Invalid Character (at character 1085) in flutter dart

Question

Here below is my token decryption code with cryptoJsKey, here encryptedText is token & password is CryptoJsKey,

 static String decryptAES(String encryptedText, String password) {
    final keyBytes = Uint8List.fromList(utf8.encode(password));
    final iv = Uint8List(16);
    final cipher = BlockCipher("AES/CBC")..init(false, ParametersWithIV(KeyParameter(keyBytes), iv));

    final encryptedBytes = base64.decode(encryptedText);
    final decryptedBytes = decryptBytes(cipher, encryptedBytes);

    final decryptedText = utf8.decode(decryptedBytes);
    return decryptedText;
  }

Here i am successfully decoded token but after token decode i am getting another cipher Text like this eyJJc1N1cGVydmlzb3IiOiJGYWxzZSIsIklzQWdlbnQiOiJGYWxzZSIsyc29XJOYW1lIjoiSml0aGl***********

for this token iam using a method for conversion

static String decodeJWT(String jwt) {
    final parts = jwt.split('.');
    if (parts.length != 3) {
      return 'Invalid JWT format';
    }
    final encodedPayload = parts[1];
    final missingPadding = 4 - (encodedPayload.length % 4);
    final paddedPayload = (missingPadding > 0) ? encodedPayload + '=' * missingPadding : encodedPayload;
    final decodedPayload = String.fromCharCodes(base64Url.decode(paddedPayload));
    print("payload $decodedPayload");
    return decodedPayload;
  }

in this conversion i am getting issue under this line final decodedPayload = String.fromCharCodes(base64Url.decode(paddedPayload)); The error message is like FormatException: Invalid character (at character 1085) ...CIsIm5iZiI6MTY5OTY1NDUxOSwiZXhwIjoxNzAwMDAwMTE5LCJpYXQiOjE2OTk2NTQ1MTl9====

Answer 1

There is some sort of issue with your algorithm. Base64 encoding should never have more than 2 characters of padding. You could go look at the spec or a reference example of code to pad the input, but dart actually provides an easier way to do it with the base64Url.normalize function.

This is how you can use it:

Uint8List base64UrlDecode(String inputBase64) {
  final normalized = base64Url.normalize(inputBase64);
  return base64Url.decode(normalized);
}

If you are still getting errors, that probably means that the encoding of the data is being done incorrectly, or you have an off-by-1 error somewhere.

---

As an aside, your code looks to have a fairly serious security vulnerability unless you're doing something outside of the decryptAES function. AES/CBC should only ever be used in addition to a MAC or hash, as otherwise it is vulnerable to bit-flipping attacks. You could probably argue this is mitigated by using a signed JWT and you might be correct, but best practice in JWE is to authenticate the entire package whether it's through the encryption algorithm or by adding a mac. If you have control of the server software, a simple(ish) fix would be to switch to AES/GCM. However, unless you are a security expert and this is just some very unfinished code, I think the adage that you shouldn't ever write your own cryptography code probably applies here. I'd recommend looking into using a library such as jose, although if your code is being used somewhere with strict security constraints you should probably have it and any libraries reviewed by a professional.

I also seriously hope that you're not using a plaintext password as the encryption key as it appears from the function. Passwords are horribly insecure as encryption keys and should always be hashed using a secure password algorithm first - not just a simple SHA, but rather something like argon2, PBKDF2, scrypt or bcrypt. If you're using a password directly, unless you can guarantee the password is always going to be 128 bits of very random data, it basically makes the encryption worthless.