Trying to decrypt a value encrypted by Postgres pgp_sym_encrypt

[eladchen]

Hi,

Take a look at the following snippet, it defines a buffer representing the db value (encryptedValueFromDatabase)

I'm using Postgres 13, and according to the docs (F.25.3.8.1. cipher-algo)
when using pgp_sym_encrypt the default cipher is aes128 with no compression.

const openpgp = require('openpgp');

// Key used for encryption
const KEY = 'REDACTED'; // can't share this

async function decryptByteArray() {
  // Encrypted value obtained from PostgreSQL's pgp_sym_encrypt
  const encryptedValueFromDatabase = Buffer.from('C30D04070302CB64B62383A829D070D24201863B5854428DCB9FFB62FFD289DE9CDFDE09B42F2C0FEAE13432EE8C7868C7E5432F63D793A36AD801E87946F95C767B1A67529818646032BC453A3F8C38BF90D4', 'hex');
  const message = await openpgp.readMessage({ binaryMessage: encryptedValueFromDatabase });
  const result = await openpgp.decryptSessionKeys({
    message,
    passwords: [KEY],
    config: {
      preferredSymmetricAlgorithm: openpgp.enums.symmetric.aes128,
      // preferredCompressionAlgorithm: openpgp.enums.compression.bzip2,
    },
  });
  const decrypted = Buffer.from(result[0].data).toString('utf-8');

  console.log('decrypted: %s', decrypted);
}

return decryptByteArray();

I'm using openpgp@5.11.0.

P.S

• I verified that using the same key with Postgres decryption function works (pgp_sym_decrypt), but that is on the DB level and doesn't help.

• I have also tried to encrypt the value using openpgp, it seems the created byte array it creates is far smaller then the one created by pgp_sym_encrypt

[larabr]

Hi, what is the question? Do you get an error, or?

[eladchen]

The decrypt fails.. any idea what am I doing wrong?

…

On Mon, Nov 13, 2023, 18:04 larabr ***@***.***> wrote: Hi, what is the question? — Reply to this email directly, view it on GitHub <#1698 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AA3V64PI2ODLFFJOIRBR3TDYEJAJVAVCNFSM6AAAAAA7H6H44SVHI2DSMVQWIX3LMV43SRDJONRXK43TNFXW4Q3PNVWWK3TUHM3TKNJVHAYTA> . You are receiving this because you authored the thread.Message ID: ***@***.***>

[twiss]

See the second half of https://github.com/openpgpjs/openpgpjs#encrypt-and-decrypt-uint8array-data-with-a-password.
You can remove the format: 'binary' from the example if you want to get the decrypted message as a Unicode string.

[eladchen]

It seems like you meant I should use sess-key when Postgres does the encryption?

There are well over 500 millions records that already exists, anything I can do using openpgp?

[larabr]

The encrypted message you shared looks fine, it should decrypt. What error message are you getting?

[rene-leanix]

@eladchen, did you solve this in the end?

[eladchen]

@rene-leanix Yes