Secure Transfer (Legacy)

https://[Link-to-Portal]?payload=QReebTFORdgX..&iv=kAO...

{
   "brandProviderTypeName":"twitter",
   "agentId":123,
   "brandProviderInstance":"twitter.com",
   "authorUUID":"b95.....",
   "authorProviderInstance":"twitter.com",          "authorAvatarUrl":"http://abs.twimg.com/sticky/default_profile_images/default_profile_normal.png",
   "imageUpload":false,
   "fileUpload":false,
   "authorProviderTypeName":"twitter",
   "authorScreenName":"cab123",
   "introMessageText":"abc",
   "createdTimeMillis":1587157642353,
   "conversationUUID":"d08...",
   "authorName":"Chris",
   "authorExternalId":"81...",
   "conversationDisplayId":123,
   "shareLocation":false,
   "brandAuthorExternalId":"856622981484879872",
   "agentUUID":"7f265fe0-186b-4ffd-b6bf-1f2e6643c017"
}

<script>
window.KHOROS_CONFIG  = {
  companyKey: 'abc,
  appId: '123',
  widgetId: '123',
  jwt: 'abcd',
  userId: '123'
};
window.addEventListener('khorosInit', function(event) {
   event.detail.sdk.updateUser({
       givenName: '',
       properties: {
           authorAvatarUrl: 'avatar url',
           conversationDisplayId: 'conversationDisplayId',
           conversationAssignedAgentId: 'agentId',
           authorScreenName: 'authorScreenName'
       }
   });
});

(function(){var scriptTag = document.createElement('script');
scriptTag.setAttribute('src','https://brand-messenger.app.khoros.com/bundle/loader.js?v=' + new Date().getTime());
document.head.appendChild(scriptTag);})();
</script>

var jwt = require('jsonwebtoken');
var KEY_ID = 'app_5deaa3example0010cc4ba4';
var SECRET = 'BFJJ88naxexampleKpBNTR';

var signJwt = function(userId) {
   return jwt.sign(
       {
           scope: 'appUser',
           userId: userId
       },
       SECRET,
       {
           header: {
               alg: 'HS256',
               typ: 'JWT',
               kid: KEY_ID
           }
       }
   );
};

public Optional<JSONObject> decryptPayload(String ivKey, String encryptedPayload) {
        if (ivKey.isEmpty() || encryptedPayload.isEmpty()) {
            return Optional.empty();
        }

        try {
            logger.debug(String.format("Starting decryption with IV %s, PAYLOAD %s", ivKey, encryptedPayload));
            final EncryptionProvider encryptionProvider = new SymmetricKeyEncryptionProvider(config.getEncryptionKey(),
                                                                                             ivKey,
                                                                                             true);


            final String plainTextPayload = encryptionProvider.decryptString(encryptedPayload);

            return Optional.of(new JSONObject(plainTextPayload));
        } catch (EncryptionException e) {
            logger.error("Issue decrypting payload: " + encryptedPayload, e);
        } catch (JSONException e) {
            logger.error("error trying to parse JSON payload", e);
        }
        return Optional.empty();
    }

import com.lithium.bandolier.encryption.errors.EncryptionException;

public interface EncryptionProvider {
    /**
     * Provide a copy of this encryption provider. (These are not thread safe!!!)
     */
    EncryptionProvider copy() throws EncryptionException;

    /**
     * Encrypts the given plain text using the secret key and iv that was already set.
     *
     * MAY NOT BE THREAD SAFE. Use .clone() to get a copy and synchronize on it!
     * @param plainText text to get encrypted
     * @return encrypted string
     */
    String encryptString(String plainText) throws EncryptionException;

    /**
     * Encrypts the given plain text using the secret key that was already set.
     *
     * MAY NOT BE THREAD SAFE. Use .clone() to get a copy and synchronize on it!
     * @param plainText text to get encrypted
     * @param ivKey the random iv byte[16] that has been base64 encoded
     * @return encrypted string
     */
    String encryptString(String plainText, String ivKey) throws EncryptionException;

    /**
     * Decrypts the text using the secret key and iv already set in this class.
     *
     * MAY NOT BE THREAD SAFE. Use .clone() to get a copy and synchronize on it!
     * @param cipherText encrypted text to get decrypted
     * @return decrypted string
     */
    String decryptString(String cipherText) throws EncryptionException;

    /**
     * Decrypts the text using the secret key and iv already set in this class.
     *
     * MAY NOT BE THREAD SAFE. Use .clone() to get a copy and synchronize on it!
     * @param cipherText encrypted text to get decrypted
     * @param ivKey the random iv byte[16] that has been base64 encoded
     * @return decrypted string
     */
    String decryptString(String cipherText, String ivKey) throws EncryptionException;

}

import com.google.common.annotations.VisibleForTesting;
import com.google.common.base.Charsets;
import com.lithium.bandolier.encryption.errors.EncryptionException;
import org.apache.commons.codec.binary.Base64;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;

import javax.annotation.concurrent.NotThreadSafe;
import javax.crypto.BadPaddingException;
import javax.crypto.Cipher;
import javax.crypto.IllegalBlockSizeException;
import javax.crypto.KeyGenerator;
import javax.crypto.NoSuchPaddingException;
import javax.crypto.SecretKey;
import javax.crypto.spec.IvParameterSpec;
import javax.crypto.spec.SecretKeySpec;
import java.security.InvalidAlgorithmParameterException;
import java.security.InvalidKeyException;
import java.security.NoSuchAlgorithmException;
import java.security.SecureRandom;
import java.util.Optional;

import static com.google.common.base.Preconditions.checkNotNull;

/**
 * Implementation of encryption using symmetric encryption with secret key and initialization vector.
 *
 * !!! WARNING !!! This class is NOT thread-safe.  To be more specific, this class can be shared across multiple threads
 * so long as one thread is doing ONLY encryption and the other thread is doing ONLY decryption.   The Cipher object is
 * what is not thread safe.
 */
@NotThreadSafe
public class SymmetricKeyEncryptionProvider implements EncryptionProvider {

    private static final Logger logger = LoggerFactory.getLogger(SymmetricKeyEncryptionProvider.class);

    private static final String AES_CBC_PKCS5_PADDING = "AES/CBC/PKCS5Padding";

    static final boolean URL_SAFE_ENCODING = true;

    static final byte[] CHUNK_SEPARATOR = {'\r', '\n'};

    private final Cipher aesEncryptCipher;  // Not ThreadSafe
    private final Cipher aesDecryptCipher;  // Not ThreadSafe
    private final SecretKey secretKey;
    private final String ivKey;
    private final boolean shouldBase64DecodeKeys;

    public SymmetricKeyEncryptionProvider(String secretKey, String ivKey) throws EncryptionException {
        this(secretKey, ivKey, false);  // for backwards compatibility
    }

    protected SymmetricKeyEncryptionProvider(final SecretKey secretKey, final String ivKey, final boolean shouldBase64DecodeKeys) throws EncryptionException {
        try {
            aesEncryptCipher = Cipher.getInstance(AES_CBC_PKCS5_PADDING);
            aesDecryptCipher = Cipher.getInstance(AES_CBC_PKCS5_PADDING);
        } catch (NoSuchAlgorithmException | NoSuchPaddingException ex) {
            logger.error("Cannot initialize cipher.", ex);
            throw new EncryptionException("Cannot initialize cipher.", ex);
        }

        this.secretKey = secretKey;
        this.ivKey = ivKey;
        this.shouldBase64DecodeKeys = shouldBase64DecodeKeys;
    }

    public SymmetricKeyEncryptionProvider(String secretKey, String ivKey, boolean shouldBase64DecodeKeys) throws EncryptionException {
        try {
            // The AES encryption in CBC mode is considered one of the most secure and fast symmetrical encryption schemes adopted by the US government and many other organizations worldwide.
            // Using default JCE provider that comes with standard JDKs to avoid problems with packaging encryption jars inside shaded mailman jar.
            aesEncryptCipher = Cipher.getInstance(AES_CBC_PKCS5_PADDING);
            aesDecryptCipher = Cipher.getInstance(AES_CBC_PKCS5_PADDING);

            checkNotNull(secretKey);

            // ----------------------------------------------------------------------
            // secret keys and IVs do not go into URLs and do not need to use Base64 URL-safe encoding
            //
            this.secretKey = new SecretKeySpec(shouldBase64DecodeKeys ? Base64.decodeBase64(secretKey.getBytes()) : secretKey.getBytes(), "AES");
            this.ivKey = checkNotNull(ivKey);
            this.shouldBase64DecodeKeys = shouldBase64DecodeKeys;
        } catch (NoSuchAlgorithmException | NoSuchPaddingException ex) {
            logger.error("Cannot initialize cipher.", ex);
            throw new EncryptionException("Cannot initialize cipher.", ex);
        }
    }

    @Override
    public EncryptionProvider copy() throws EncryptionException {
        return new SymmetricKeyEncryptionProvider(new SecretKeySpec(this.secretKey.getEncoded(), "AES"), ivKey, shouldBase64DecodeKeys);
    }

    @Override
    public String encryptString(String plainText) throws EncryptionException {
        return encryptString(plainText, ivKey);
    }

    @Override
    public String encryptString(String plainText, String ivKey) throws EncryptionException {
        try {
            aesEncryptCipher.init(Cipher.ENCRYPT_MODE, secretKey, getIVSpec(ivKey));
            byte[] encryptedBytes = aesEncryptCipher.doFinal(plainText.getBytes(Charsets.UTF_8));
            // ----------------------------------------------------------------------
            // we use the static method instead of the instance supplied by this.createBase64()
            // because the static method has extra error handling already built in.  There is
            // a dependency between the args used here and the args used in the constructor inside
            // this.createBase64().
            //
            byte[] encodedBytes = Base64.encodeBase64(encryptedBytes, false, URL_SAFE_ENCODING);
            return encodedBytes == null ? null : new String(encodedBytes, Charsets.UTF_8);
        } catch (InvalidAlgorithmParameterException | InvalidKeyException | IllegalBlockSizeException | BadPaddingException ex) {
            logger.warn("Cannot encrypt string.", ex);
            throw new EncryptionException("Cannot encrypt string.", ex);
        }
    }

    @Override
    public String decryptString(String cipherText) throws EncryptionException {
        return decryptString(cipherText, ivKey);
    }

    @Override
    public String decryptString(String cipherText, String ivKey) throws EncryptionException {
        try {
            aesDecryptCipher.init(Cipher.DECRYPT_MODE, secretKey, getIVSpec(ivKey));
            // ----------------------------------------------------------------------
            // The built in static methods do not have a form that allows URL safe decoding, so
            // we construct the right type of Base64 and then decode directly with it.
            //
            final Base64 b64 = createBase64();
            byte[] decodedCipherText = b64.decode(cipherText.getBytes(Charsets.UTF_8));
            return new String(aesDecryptCipher.doFinal(decodedCipherText), Charsets.UTF_8);
        } catch (IllegalBlockSizeException | InvalidKeyException | InvalidAlgorithmParameterException | BadPaddingException ex) {
            logger.info("Cannot decrypt string");
            throw new EncryptionException("Cannot decrypt string.", ex);
        }
    }

    /**
     * Create a new initialization-vector to facilitate rotating IV's in application code for each piece of data.
     * @return a SecureRandom initialized byte[16] that has been base64 encoded.
     */
    public static String generateNewIV() {
        byte[] iv = new byte[16];
        new SecureRandom().nextBytes(iv);
        // ----------------------------------------------------------------------
        // secret keys and IVs were NOT encoded with URL_SAFE base64 originally, and there is no point
        // and much risk in changing them.  So, we leave their codec unchanged.
        //
        return new String(Base64.encodeBase64(iv, false), Charsets.UTF_8);
    }

    public static Optional<String> generateNewKey() {
        try {
            final int keyLength = 256;
            final String algorithm = "AES";

            final KeyGenerator keyGen = KeyGenerator.getInstance(algorithm);
            keyGen.init(keyLength);
            final SecretKey secretKey = keyGen.generateKey();
            return Optional.of(Base64.encodeBase64String(secretKey.getEncoded()));
        } catch (NoSuchAlgorithmException e) {
            logger.error("Unable to generate an encryption key", e);
            return Optional.empty();
        }
    }

    @VisibleForTesting
    Base64 createBase64() {
        return new Base64(0 /* means no chunking */, CHUNK_SEPARATOR, URL_SAFE_ENCODING);
    }

    private IvParameterSpec getIVSpec(String ivKey) {
        // ----------------------------------------------------------------------
        // secret keys and IVs were NOT encoded with URL_SAFE base64 originally, and there is no point
        // and much risk in changing them.  So, we leave their codec unchanged.
        //
        return new IvParameterSpec(shouldBase64DecodeKeys ? Base64.decodeBase64(ivKey.getBytes()) : ivKey.getBytes());
    }
}

import com.google.common.io.BaseEncoding;

import javax.annotation.Nullable;
import javax.crypto.BadPaddingException;
import javax.crypto.Cipher;
import javax.crypto.IllegalBlockSizeException;
import javax.crypto.NoSuchPaddingException;
import javax.crypto.spec.GCMParameterSpec;
import javax.crypto.spec.IvParameterSpec;
import javax.crypto.spec.SecretKeySpec;
import java.security.InvalidAlgorithmParameterException;
import java.security.InvalidKeyException;
import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;
import java.security.SecureRandom;
import java.util.Arrays;

import static java.nio.charset.StandardCharsets.UTF_8;

public class Cryptor {

    public static final String AES_GCM = "AES/GCM/NoPadding";
    public static final String AES_CBC = "AES/CBC/PKCS5PADDING";


    private final SecretKeySpec secretKey;
    private final SecureRandom secureRandom;

    public Cryptor(String encryptionKey) {
        try {
            this.secretKey = new SecretKeySpec(aesHashBlock(encryptionKey), "AES");
            this.secureRandom = new SecureRandom();
        } catch (NoSuchAlgorithmException nsae) {
            throw new RuntimeException(nsae);
        }
    }

    // encryptionKey byte array must be a valid AES key size.
    public Cryptor(byte[] encryptionKey)  {
        this.secretKey = new SecretKeySpec(encryptionKey, "AES");
        this.secureRandom = new SecureRandom();
    }

    /**
     * Securely generate N bytes of random data and return as base64 encoded string.
     * @return base64 encoded string
     */
    public String randomBase64(int size) {
        byte[] bytes = new byte[size];
        secureRandom.nextBytes(bytes);
        return BaseEncoding.base64().encode(bytes);
    }

    /**
     * Generate a 128 bit hash block from a provided string for use in AES calculations.
     * @param s performs a SHA-256 hash and returns first 16 bytes.
     * @return byte array of hash
     * @throws NoSuchAlgorithmException
     */
    public byte[] aesHashBlock(String s) throws NoSuchAlgorithmException {
        MessageDigest md = MessageDigest.getInstance("SHA-256");
        md.update(s.getBytes(UTF_8));
        // Return only 16 bytes of the hash
        return Arrays.copyOf(md.digest(), 16);
    }

    public byte[] decryptCBC(byte[] value, byte[] iv)
            throws BadPaddingException, InvalidAlgorithmParameterException, IllegalBlockSizeException,
                   InvalidKeyException, NoSuchAlgorithmException, NoSuchPaddingException {
        Cipher cipher = Cipher.getInstance(AES_CBC);
        cipher.init(Cipher.DECRYPT_MODE, secretKey, new IvParameterSpec(iv));
        return cipher.doFinal(value);
    }

    public byte[] decryptGCM(byte[] value, byte[] iv, @Nullable  byte[] aad)
            throws BadPaddingException, InvalidAlgorithmParameterException, IllegalBlockSizeException,
                   InvalidKeyException, NoSuchAlgorithmException, NoSuchPaddingException {
        Cipher cipher = Cipher.getInstance(AES_GCM);
        cipher.init(Cipher.DECRYPT_MODE, secretKey, new GCMParameterSpec(128, iv));

        if (aad != null) {
            cipher.updateAAD(aad);
        }

        return cipher.doFinal(value);
    }

    public byte[] encryptCBC(byte[] value, byte[] iv)
            throws BadPaddingException, IllegalBlockSizeException, InvalidAlgorithmParameterException,
                   InvalidKeyException, NoSuchPaddingException, NoSuchAlgorithmException {
        Cipher cipher = Cipher.getInstance(AES_CBC);
        cipher.init(Cipher.ENCRYPT_MODE, secretKey, new IvParameterSpec(iv));
        return cipher.doFinal(value);
    }

    public byte[] encryptGCM(byte[] value, byte[] iv, @Nullable  byte[] aad)
            throws BadPaddingException, IllegalBlockSizeException, InvalidAlgorithmParameterException,
                   InvalidKeyException, NoSuchPaddingException, NoSuchAlgorithmException {
        Cipher cipher = Cipher.getInstance(AES_GCM);
        cipher.init(Cipher.ENCRYPT_MODE, secretKey, new GCMParameterSpec(128, iv));

        if (aad != null) {
            cipher.updateAAD(aad);
        }

        return cipher.doFinal(value);
    }

}

public class EncryptionException extends Exception {

    public EncryptionException(String message, Throwable ex) {
        super(message, ex);
    }
}