0

I am trying to implement a messaging system into a website. The messages between two user should be E2E encrypted. There is a wonderful tutorial at https://getstream.io/blog/web-crypto-api-chat/, that I used as a guide for implementation. For the encryption/decryption I use the WebCrypto API.

  1. Each user get's an EC-256 (public, private)-keypair generated.
  2. Messages between two users will be encrypted with the AES-GCM algorithm using an IV and the secret key derived from the sender's private and the receivers public key.

So far, so good, in the most cases this works perfectly: the message to send will be encrypted on the client, sent to the server and stored in the database as an incomprehensible string. If one of the user's is logged in again on the website and opens the conversation, the messages will be decrypted and are readable again for both user's...BUT certain messages can't be decrypted for some reason. I get this common error message, which can be found in numerous threads:

DOMException: The operation failed for an operation-specific reason

Unfortunately, for security reasons, the browser does not show more details about what is going wrong. It also makes no difference which browsers I use, it's always the same messages that can't be decrypted. But this is probably an indication that something is going wrong with the encryption, so that the decryption can no longer work. But on the other side I can't experience any errors in the console when encrypting a message, which can't be decrypted later.

Has anyone had experience with something like this?

Thank you and best regards

Att89
  • 1
  • Please provide enough code so others can better understand or reproduce the problem. – Community Mar 18 '22 at 14:01
  • As the community Bot indicates, it's hard to determine the issue without details. Might be worthwhile taking a look at https://stackoverflow.com/questions/66155504/webcrypto-api-domexception-the-provided-data-is-too-small – Trentium Mar 19 '22 at 01:01
  • Thank you for your response. It is not really practical to implement e2ee in the browser anyway, because you always have difficulties to store the private key securely, but at the same time make sure that it is available to the user in every other device. For this reason we decided to take a completely different approach. – Att89 Mar 19 '22 at 10:31

0 Answers0